049734-coinbase[.]com

The domain 049734-coinbase.com is identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis confirms the domain was actively used to deceive users by mimicking legitimate Coinbase services. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered through Sav.com, LLC on November 29, 2025, and resolved to the IP address 172.173.173.90, hosted under AS8075 (Microsoft Corporation) in the United States. Security vendors flagged the domain as malicious, with 19 of 95 VirusTotal engines detecting it as a phishing threat. Google Safe Browsing also classified it as phishing, and it appeared on at least one security blocklist. Notably, the domain lacked an SSL certificate, increasing its detectability as fraudulent. The page title, identical to the domain name (049734-coinbase.com), further indicates a lack of effort to appear legitimate. Given the domain's current offline status, immediate threats are mitigated; however, users who may have interacted with it should take precautionary measures. Organizations and individuals are advised to block the domain and its associated IP (172.173.173.90) at the network level. Users should verify the authenticity of any communication or website claiming affiliation with Coinbase by cross-referencing official domains. Monitoring for similar impersonation attempts, particularly those using numeric prefixes or subdomains, is recommended. Security teams should update detection rules to include this domain and its indicators of compromise.