thecoinbase[.]us

Analysis of the domain thecoinbase.us, created on January 22 2025 and currently taken offline, shows a clear pattern of brand impersonation aimed at Coinbase users. The domain resolves to IP address 64.90.52.178, which is hosted in the United States under AS26347 New Dream Network, LLC, and is served by Apache HTTP Server. The site presented an HTTP 200 response and used a Let’s Encrypt R13 certificate, indicating that TLS was active at the time of observation. The page title retrieved was "thecoinbase.us is almost here!", matching the known branding of the target.

The registrar listed for the domain is ENOM, INC., and the authoritative nameservers are ns1.dreamhost.com, ns2.dreamhost.com, and ns3.dreamhost.com. VirusTotal recorded 13 detections out of 95 security vendors, confirming that multiple scanners flagged the domain as malicious. The domain appears on one security blocklist and has been blocked by PhishDestroy, reinforcing its classification as a crypto‑related scam. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious intent.

The intelligence indicates the site was designed to lure victims into a cryptocurrency scam, but the exact payload or credential‑capture mechanism has not been publicly disclosed. Uncertainty remains around the specific phishing page content, any associated command‑and‑control infrastructure, and whether additional phishing kits were deployed. Defenders should add the IP 64.90.52.178 and the domain thecoinbase.us to firewall and proxy block lists, monitor DNS queries for the listed DreamHost nameservers, and enforce outbound filtering for Let’s Encrypt‑issued certificates from untrusted domains. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related indicators, and incident response teams should be prepared to investigate potential credential leakage targeting Coinbase accounts.