392847-coinbase[.]com

On August 03, 2026, the domain 392847-coinbase.com was identified as a high-risk phishing domain. Analysis indicates that this domain appears on three security blocklists, suggesting a heightened level of suspicion. It is blocked by PhishDestroy, MetaMask, and SEAL, which are known for their stringent security measures. The domain was first registered on August 02, 2026, through DYNADOT LLC, and is currently active.

The domain uses advanced technologies such as HSTS, Cloudflare, and HTTP/3, which can indicate efforts to appear legitimate and evade detection. The domain resolves to the IP address 104.21.21.81, and its nameservers are managed by Cloudflare at milan.ns.cloudflare.com and rayne.ns.cloudflare.com. According to Google Safe Browsing, the domain is flagged for social engineering, which often involves deceptive tactics to trick users into divulging sensitive information. In an AlienVault OTX threat intelligence pulse, this domain was mentioned, further validating its association with malicious activity.

While 7 of 91 security vendors have flagged this domain on VirusTotal, the majority have not yet identified it, which may reflect the domain's recent creation or a need for further analysis. Defenders should be cautious and consider blocking this domain at the network and endpoint levels. The exact content of the domain has not been analyzed, but the risk indicators suggest that it may be part of a phishing campaign targeting users of cryptocurrency platforms or financial services. Continuous monitoring and user education are recommended to mitigate potential risks.