team-coinbase[.]store

Analysis of team-coinbase.store shows a confirmed brand‑impersonation campaign targeting Coinbase users. The domain, created on February 21, 2026, resolves to IP address 34.120.137.41, which is hosted within Google LLC’s network (AS396982) in the United States. The site is currently offline, and its SSL certificate is rated E8, indicating a weak or mis‑issued certificate. The page title returned by the server reads "Coinbase: Buy and Sell Bitcoin Securely | Coin Base," directly mirroring the legitimate brand’s messaging and supporting the impersonation classification.

VirusTotal records indicate that 14 of 93 scanning engines have flagged the domain as malicious, reinforcing the suspicion of a crypto‑scam payload. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy mitigation service. Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low reputation. Defenders should immediately add team-coinbase.store to deny‑list rules across DNS, proxy, and endpoint solutions, and consider blocking the associated IP 34.120.137.41 to prevent any residual traffic.

Monitoring for any resurrection of the domain or the reuse of the same IP for related campaigns is advisable. Since the domain is offline, any active phishing attempts are likely halted, but the infrastructure—especially the Google‑hosted IP—may be repurposed for future impersonation attempts. Continuous re‑evaluation of the IP reputation and periodic re‑scans of the domain, should it become active again, are recommended to maintain protection against evolving brand‑impersonation threats.