colnbasse[.]com

The domain colnbasse.com was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows it resolves to the IP address 209.38.63.194, which belongs to DigitalOcean, LLC (AS14061) and is geolocated in the United States. The site’s SSL certificate is identified as grade E7, indicating a low‑trust certificate. The page title returned by the server is exactly "colnbasse.com," providing no additional context about the content hosted.

Threat intelligence records classify this domain as a brand‑impersonation campaign targeting Coinbase, and it appears on a single security blocklist that is currently enforced by PhishDestroy. AlienVault OTX contains references to this domain in 27 distinct threat‑intel pulses, reinforcing its association with malicious activity. VirusTotal scans reported that four of ninety‑three security vendors flagged the domain, suggesting a modest but measurable detection rate among commercial scanners. Although the site is offline, its previous activity demonstrates a pattern consistent with credential‑collection or account‑takeover attempts aimed at Coinbase users.

Uncertainty remains regarding the exact payload or phishing page design, as no page content has been captured in the available data. Defenders should continue to block the IP 209.38.63.194, add colnbasse.com to local and network‑wide blocklists, and monitor for any re‑registration or resurrection of the domain. Ongoing scrutiny of DigitalOcean infrastructure for similar impersonation domains is recommended, as is periodic re‑query of threat‑intel feeds to capture any new pulses or vendor detections related to this indicator.