340590coinbase[.]com

Analysis of 340590coinbase.com indicates that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The authoritative name servers are arely.ns.cloudflare.com and rajeev.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS service. The domain presents a TLS certificate issued to PhishDestroy / botadmin.destroy.tools, a pattern frequently observed in malicious infrastructure. The page title returned by the server is “340590coinbase.com”, matching the domain name and reinforcing the intent to mimic the legitimate Coinbase brand. VirusTotal records show that 7 of 93 scanning engines flagged the domain, confirming the presence of malicious components.

AlienVault OTX references the domain in one threat‑intelligence pulse, and the domain appears on three external blocklists. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of reputable reputation. The domain resolves to the loopback address 127.0.0.127, and the current HTTP status is offline, suggesting that the site has been taken down or deliberately disabled. Blocking services such as PhishDestroy, MetaMask, and SEAL have listed the domain as malicious, and the identified scam type is a crypto‑related scam targeting Coinbase users.

The available evidence confirms a brand‑impersonation campaign aimed at Coinbase customers, likely intended to harvest credentials or cryptocurrency. However, the exact content of the landing page has not been captured, and the specific phishing kit or payload remains unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the domain or associated IP addresses, and incorporate the indicator set (domain, certificate subject, nameservers, registrar) into threat‑intel feeds. Ongoing observation of related Cloudflare name‑server patterns and the NiceNIC registrar may reveal additional infrastructure used by the threat actor.