coinbasewalletapi[.]com

The domain coinbasewalletapi.com was observed hosting a site that returned HTTP status 200 with the page title “Domain for Sale”. The site employed a Let’s Encrypt R12 TLS certificate, indicating active HTTPS service at the time of observation. DNS resolution pointed to IP address 62.204.35.189, which is associated with AS62005 BlueVPS OU and located in the United States. The domain’s authoritative nameservers were listed as brodie.ns.cloudflare.com and gina.ns.cloudflare.com, both Cloudflare‑managed.

Registration data shows the domain was created on December 6, 2025 and was registered through OwnRegistrar, Inc. The domain was flagged by the PhishDestroy blocklist and appears on one additional security blocklist. A Gridinsoft trust score of 0 out of 100 was recorded, suggesting a lack of reputation. VirusTotal scanned the domain and 14 of 93 security vendors reported it as malicious, reinforcing the suspicion of abuse. The intelligence categorizes the activity as a crypto‑related scam that impersonates the Coinbase brand, aligning with the listed brand target of Coinbase and the scam type “Crypto Scam”.

The domain’s current status is offline, indicating that the malicious content may have been removed or the hosting withdrawn. While the observed evidence confirms a brand‑impersonation infrastructure, the exact content of the now‑offline site remains unknown beyond the generic “Domain for Sale” title. Defenders should continue to monitor the associated IP address and ASN for any re‑use, enforce blocklist updates to include the domain and its IP, and consider adding the domain to internal URL filtering policies. Given the low trust score and multiple vendor detections, any future resolution of the domain should be treated as high‑risk and blocked pending further analysis.