koinbasetrade[.]com

The domain koinbasetrade.com is currently listed as offline but historical observations indicate it was used in a high‑risk brand‑impersonation campaign aimed at Coinbase users. The site was registered on 22 January 2025 through Cosmotown, Inc. and resolves to the IPv4 address 37.27.71.198, which belongs to AS24940 (Hetzner Online GmbH) in Finland. DNS resolution is provided by ns1.dnspark.in and ns2.dnspark.in. No TLS certificate was presented, meaning the site operated without HTTPS protection.

Google Safe Browsing classified the domain under the “social engineering” category, consistent with its designation as a crypto scam. VirusTotal reports that 10 of 95 scanners flagged the domain, and it appears on at least one external blocklist. The page title returned by the server was “Account Suspended – Razorhost,” offering no direct evidence of a Coinbase‑specific login page. The infrastructure was blocked by the PhishDestroy service, and the domain has been taken offline.

Analysts lack further content‑level details, such as the exact HTML or credential‑capture mechanisms, because the site is no longer reachable. Defenders should continue to deny traffic to 37.27.71.198, add koinbasetrade.com to URL filtering and host‑based blocklists, and monitor for any re‑registration attempts that reuse the same name servers or hosting provider. Ongoing vigilance is advised given the recent creation date and the demonstrated willingness of threat actors to weaponize newly registered domains for cryptocurrency‑related fraud.