preview-coinbase[.]com

This domain, preview-coinbase.com, is identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic the legitimate Coinbase interface, likely to deceive users into submitting credentials or financial information under false pretenses. No explicit crypto drainer kit signatures were detected in initial scans, but the presence of jQuery and PHP suggests dynamic content delivery, which is commonly exploited in credential harvesting schemes.

Technical indicators confirm the domain's malicious classification. VirusTotal reports 23 out of 95 security vendors flagging preview-coinbase.com as malicious. The domain was registered on March 04, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.155.204, which is part of a network known for hosting phishing infrastructure. The domain appears on three security blocklists—PhishDestroy, PhishingArmy, and InversionDNS—and is referenced in one AlienVault OTX threat intelligence pulse. Gridinsoft assigns it a trust score of 0/100, further corroborating its malicious nature. Technologies detected include PHP, jQuery, Cloudflare Browser Insights, and Cloudflare, with HTTP/3 support, indicating modern infrastructure potentially used to evade detection.

As of the latest assessment, preview-coinbase.com has been taken offline, reducing immediate exposure risk. However, the domain's infrastructure remains registered and could be reactivated or repurposed. Organizations are advised to block the domain and its resolving IP at the network perimeter. Users who may have interacted with the domain should reset credentials and monitor accounts for unauthorized activity. Given the domain's registration date in 2026, this may indicate either a typo-squatting attempt or a forward-dated registration to evade temporal analysis. Continued monitoring of related infrastructure is recommended due to the persistent nature of such threats.