coinbasevip2012[.]net

Analysis of the domain coinbasevip2012.net indicates a confirmed phishing campaign targeting Coinbase users, classified as a crypto scam. The domain was registered on October 24, 2025, through GoDaddy.com, LLC, and is currently offline, returning a 522 connection timeout error with the page title 'coinbasevip2012.net | 522: Connection timed out.' Infrastructure analysis reveals the domain resolved to the IP address 104.21.45.114, hosted on Cloudflare's network (AS13335) in the United States, with nameservers BYRON.NS.CLOUDFLARE.COM and MOLLY.NS.CLOUDFLARE.COM. The SSL certificate is identified as WE1, though no further details about its validity or issuer are available. Detection data from security vendors shows 16 of 93 engines on VirusTotal flagged the domain as malicious, while PhishDestroy has actively blocked it.

The domain appears on one security blocklist, and Gridinsoft assigns it a trust score of 0 out of 100, reinforcing its high-risk classification. The scam type is explicitly labeled as a crypto scam, and the domain impersonates Coinbase, though the exact content or mechanics of the phishing page remain unconfirmed due to its current offline status. Defenders should treat this domain as a confirmed threat vector.

Network-level blocking of the IP 104.21.45.114 and the domain itself is recommended, along with monitoring for related infrastructure, such as additional domains registered through GoDaddy or hosted on Cloudflare. Given the domain's recent creation and active detection by multiple vendors, organizations should prioritize alerting users about potential crypto-related phishing attempts linked to this campaign. Further investigation into the SSL certificate and historical DNS records may provide additional context for tracking the threat actor's infrastructure.