803318coinbase[.]com

On July 24, 2026, the domain 803318coinbase.com was observed hosting a credential-capture page titled "Sign in". The site is registered through NiceNIC International Group Co., Limited and was created on March 06, 2026. Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, which is part of AS13335 Cloudflare, Inc. and is geolocated to the United States. No SSL certificate was presented during connection attempts, indicating the site operated over plain HTTP.

The domain appears on three public security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans report that two of ninety‑five antivirus engines flagged the domain as malicious. The site is classified as a "Crypto Scam" and impersonates the cryptocurrency exchange brand Coinbase, as indicated by the brand target field. Nameserver records point to brodie.ns.cloudflare.com and paige.ns.cloudflare.com, consistent with the Cloudflare hosting infrastructure.

Defenders should treat the domain as high‑risk despite the limited detection count, because the combination of brand impersonation, lack of TLS, and blocklist presence suggests a purposeful phishing campaign. Immediate mitigation steps include adding the domain to network‑level deny lists, updating web‑proxy and email security policies to block requests to 803318coinbase.com, and monitoring for any future re‑registration of the domain or related subdomains. Analysts should also watch for similar patterns of registration through NiceNIC and use of Cloudflare name servers, as these have appeared in prior cryptocurrency‑related phishing operations. At present, no additional content beyond the page title has been publicly disclosed, so further investigation of the landing page payload is recommended if the domain resurfaces.