balance[.]email

This domain, balance.email, is actively engaged in high-risk brand-impersonation phishing targeting Coinbase users. Registered on September 23, 2018, through NameCheap, Inc., the domain resolves to the IP address 159.89.234.71. Analysis of available metadata reveals a page title explicitly designed to deceive: 'Balance: Daily email containing your Coinbase balance.' This phrasing aligns with known tactics used to lure victims into disclosing credentials or financial information under the pretense of account verification or balance updates. Infrastructure analysis indicates the domain remains operational as of July 12, 2026, with a Let's Encrypt SSL certificate in place, which may lend a superficial appearance of legitimacy. Detection metrics show limited but consistent flagging: four of ninety-five security vendors on VirusTotal have classified the domain as malicious, and it appears on two security blocklists, including PhishDestroy and BLP-Malware. Additionally, the domain has been referenced in twenty-three threat intelligence pulses on AlienVault OTX, suggesting a pattern of malicious activity over time. Defenders should note that while the domain has been active for nearly eight years, its registration age does not preclude ongoing abuse. The Gridinsoft trust score of 0/100 further corroborates its classification as high-risk. Given the explicit targeting of Coinbase users, organizations should prioritize blocking this domain at the DNS and proxy levels, as well as monitoring for related email campaigns distributing links to balance.email. The exact content and functionality of the phishing page remain unanalyzed, but the combination of brand impersonation, active status, and detection metrics warrants immediate mitigation.