14735-coinbase[.]com

The domain 14735-coinbase.com has been identified as a high-risk phishing resource specifically designed for brand impersonation targeting Apple users. Analysis confirms the domain presented a fraudulent login interface titled 'Coinbase - Sign In,' despite its primary objective being the theft of Apple account credentials. This discrepancy between the displayed brand and the targeted brand is a hallmark of credential harvesting campaigns seeking to exploit user trust in well-known platforms. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious registrations. The domain resolved to the IP address 176.65.132.88, hosted within the NL-based autonomous system AS51396 (Pfcloud UG), a network segment with a documented history of hosting phishing infrastructure. Detection metrics indicate the domain was flagged by 22 of 95 security vendors on VirusTotal, while appearing on three distinct security blocklists. The absence of an SSL certificate further compounds the risk, as unencrypted connections facilitate interception of sensitive data. Additional protective measures were observed, including blocks by PhishDestroy, MetaMask, and SEAL, underscoring the domain's malicious intent. As of the latest assessment, 14735-coinbase.com has been taken offline, though residual risks persist due to potential re-registration or migration to alternative infrastructure. Organizations and individuals are advised to implement the following mitigations: (1) Block the domain and its associated IP (176.65.132.88) at the network perimeter; (2) Monitor for residual DNS queries or cached resolutions; (3) Deploy endpoint protection rules to detect and prevent access to domains registered via NiceNIC or resolving to AS51396; (4) Educate users on recognizing brand impersonation tactics, particularly those involving mismatched branding and login prompts; (5) Report the domain to relevant security communities to aid in broader threat intelligence sharing. Given the domain's creation date in the future (2026), this incident highlights the necessity of validating domain registration timestamps as part of routine threat analysis.