coinbaseoc[.]com

Analysis of coinbaseoc.com indicates a high‑risk brand‑impersonation operation targeting Coinbase users. The domain was registered on August 21, 2025 through Name.com, Inc. and currently resolves to IP address 172.67.154.208, which is part of Cloudflare’s AS13335 network located in the United States. DNS resolution is handled by the authoritative nameservers piotr.ns.cloudflare.com and rayne.ns.cloudflare.com, confirming that the infrastructure is fully hosted behind Cloudflare’s edge services and delivers content over HTTP/3 with a valid SSL certificate issued by Google Trust Services under the WE1 root. The web server returns HTTP 200, and the page title reads “Buy & Sell Bitcoin, Ether | Cryptocurrency Exchange,” a generic cryptocurrency offering that aligns with the listed scam type of a Crypto Scam.

The domain appears on three independent security blocklists—PhishDestroy, ScamSniffer, and Enkrypt—and is flagged by Google Safe Browsing for social engineering. AlienVault OTX references the domain in two threat‑intel pulses, reinforcing its reputation as a malicious indicator. VirusTotal analysis shows that 15 of 95 scanned security vendors flag the domain, providing additional corroboration of its suspicious nature. Reputation services assign extremely low trust scores: Scamadviser rates it 1 / 100 and Gridinsoft 4 / 100, reflecting a consensus of malicious intent.

Defenders should treat coinbaseoc.com as an active threat. Network‑level controls should block traffic to the domain and its associated IP range, and email gateways should deny any messages containing links to the domain. Endpoint protection solutions should incorporate the observed VirusTotal detections and the blocklist entries to raise alerts on attempted access. Continuous monitoring of Cloudflare‑hosted IPs linked to the domain is advised, as the attacker may pivot to additional sub‑domains or use the same infrastructure for other impersonation campaigns.