tokenmanager[.]coinbase[.]cm

This domain, tokenmanager.coinbase.cm, was registered on March 6, 2026, through Netcom.cm Sarl and is actively impersonating Coinbase as part of a cryptocurrency scam. Infrastructure analysis reveals the domain resolves to 34.111.46.214, hosted on AS396982 within the United States, and uses nameservers ns1.adtraks.com and ns2.adtraks.com. The site employs a Let's Encrypt SSL certificate issued under the YR2 policy, which does not inherently indicate malicious intent but is commonly exploited by threat actors for legitimacy signaling. Current detection metrics show 12 out of 95 security vendors flagging the domain on VirusTotal, while one security blocklist has already listed it. The domain presents a 302 HTTP status code, suggesting an active redirect mechanism that may lead users to fraudulent cryptocurrency wallets or credential harvesting pages. The use of a .cm top-level domain, historically associated with typosquatting and brand impersonation, aligns with known tactics for targeting users attempting to access legitimate services. While the domain's creation date is recent, its continued operation and lack of takedown indicate persistent malicious intent. The nameserver provider, adtraks.com, has been previously linked to other phishing campaigns, though attribution to a specific threat actor remains unverified. Defenders should prioritize blocking this domain at the DNS and network layers, particularly in environments where cryptocurrency transactions occur. The IP address 34.111.46.214 should be monitored for additional malicious domains resolving to it, as shared hosting infrastructure is a common indicator of coordinated phishing operations. Endpoint protection systems should be updated to detect and prevent access to tokenmanager.coinbase.cm, and security teams should investigate any prior connections to this domain within their logs. Given the domain's active status and high-risk classification, user awareness campaigns should emphasize the risks of interacting with unofficial Coinbase domains, especially those using non-standard TLDs or subdomains.