oinb-ase[.]com

Analysis of the domain oinb-ase.com indicates high-risk brand impersonation activity targeting Coinbase users. The domain was registered on November 19, 2025, through Metaregistrar BV and currently resolves to the IP address 50.30.32.108. As of July 12, 2026, the domain remains active and is flagged by five out of ninety-five security vendors on VirusTotal, alongside listings on two distinct blocklists: PhishDestroy and BLP-Malware. Additionally, the domain appears in twenty-three threat intelligence pulses on AlienVault OTX, suggesting persistent malicious activity. The page title, 'This is a temporary page generated for your account by AfeesHost,' does not explicitly confirm the nature of the content but aligns with patterns observed in phishing infrastructure. The domain employs a Let's Encrypt SSL certificate and supports HTTP/3, which may be leveraged to evade detection or enhance perceived legitimacy. While the specific content hosted on the domain has not been analyzed, the combination of brand impersonation targeting Coinbase, active blocklist presence, and threat intelligence reporting strongly suggests malicious intent. Defenders should treat this domain as hostile infrastructure. Network-level blocking of 50.30.32.108 and oinb-ase.com is recommended, along with monitoring for related domains registered through Metaregistrar BV that may exhibit similar characteristics. The domain's creation date and continued activity indicate a sustained campaign, and further investigation into associated IP ranges or hosting providers may reveal additional compromised assets. Given the high detection rate across multiple security platforms, organizations should prioritize this domain in their threat mitigation strategies.