prime-coinbasee[.]us

Analysis indicates that prime-coinbasee.us was registered on 16 November 2025 through ENOM, INC. The domain resolves to the IPv4 address 185.145.97.35, which belongs to Hostwinds LLC operating under ASN 54290 in the Netherlands. The hosting provider’s nameservers amsbs1.hostwindsdns.com and amsbs2.hostwindsdns.com are actively configured for the domain. No TLS certificate is presented; HTTPS connections are unavailable, suggesting the site was intended to be accessed over HTTP only. The domain is currently taken offline, and the last known status is “offline” as of the report date.

VirusTotal records show that 12 of 95 scanned security vendors flagged the domain, providing an early indication of malicious intent. It appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 / 100, reinforcing the low credibility assessment. The domain is classified as a crypto‑related scam and is explicitly marked as impersonating the Coinbase brand.

No Safe Browsing, Open Threat Exchange, or page‑title data are available for further correlation. Given the observed infrastructure, defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any re‑activation, and add the domain to internal blacklists. Organizations that use Coinbase services should educate users about the lack of SSL, the recent creation date, and the low trust score, and advise them to verify URLs before entering credentials. Ongoing threat‑intel feeds should be consulted for any future redeployment of the same hosting assets.