coinbased[.]me

On July 23, 2026 analysts reviewed coinbased.me, a domain that surfaced as a brand‑impersonation operation targeting Coinbase. The domain was registered on November 10, 2025 through Gname.com Pte. Ltd. and is configured with the authoritative name servers a.share-dns.com, a4.share-dns.com, b.share-dns.net, and b4.share-dns.net. DNS resolution points to IP address 43.162.108.145, an address located in the United States and assigned to AS132203, identified as a Tencent Building on Kejizhongyi Avenue. No TLS certificate was observed for the host, indicating that traffic would be served over plain HTTP.

The site’s HTML title reads “Global travel guide,” a content label that does not align with the claimed Coinbase impersonation and suggests a possible content‑cloaking tactic. The infrastructure has been classified as a crypto‑scam, and the domain is listed on one security blocklist, with PhishDestroy confirming the block. VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the domain, reinforcing its malicious reputation. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of abuse.

The domain’s current status is offline, but historical activity indicates it was actively used to lure victims under the guise of a travel guide while exploiting Coinbase branding. Defensive recommendations include adding coinbased.me and its resolving IP 43.162.108.145 to network deny lists, monitoring for any re‑registration attempts, and extending watchlists to the associated nameservers and registrar. Continuous observation of related Tencent‑hosted assets is advised, as threat actors frequently reuse hosting clusters for subsequent campaigns.