supports[.]name

On July 23, 2026, analysis of the domain supports.name identified a brand‑impersonation campaign targeting Coinbase. The site’s HTTP response contained the page title “Contact Coinbase Support”, directly referencing the targeted brand. The domain resolves to the IPv4 address 82.221.139.116, which belongs to AS50613 (Advania Island ehf) located in Iceland. Registration information shows the domain was created through IS‑ICENETWORKS, and the authoritative name servers are dns1.icedns.is and dns2.icedns.is. No TLS certificate was presented, indicating the site operates without encryption.

The host is currently marked offline, and the domain has been taken down by the hosting provider. Nevertheless, the infrastructure remains observable and has already been added to at least one security blocklist. PhishDestroy confirmed the domain as malicious, and AlienVault OTX includes it in one threat‑intelligence pulse. VirusTotal scans reported 15 out of 95 antivirus engines flagging the host as malicious, and Gridinsoft assigned a trust score of 0 / 100. The overall risk rating is elevated.

Uncertainty remains regarding the exact content served before takedown, as the page has not been captured in a public archive. Analysts cannot confirm whether credential‑harvesting forms were present or if additional malicious payloads were delivered. Despite the offline status, the associated IP address and registrar information should be added to network deny lists, and any outbound connections to the domain or its IP be blocked. Continuous monitoring of the AS50613 range for re‑use of the domain or similar hostnames is advised. Organizations using Coinbase services should educate users to verify URLs and avoid entering credentials on sites lacking TLS.