psrvt-coinbase[.]com

This domain, psrvt-coinbase.com, was registered on 25 November 2025 through NiceNIC International Group Co., Limited and is currently taken offline. The site is explicitly listed as a crypto‑scam that impersonates the Coinbase brand. Network resolution points to IP address 91.92.241.15, which belongs to the Netherlands and is announced by ASN 202412 operated by Omegatech LTD. The authoritative name servers are ns1.virtualine.org and ns2.virtualine.org. No TLS certificate is presented, indicating the site does not serve HTTPS traffic.

The only observable HTTP response contains the page title “Checking Connection – Please Wait”, which is consistent with a redirection or loading stage often used in credential‑harvesting flows. Threat intelligence shows the domain appears on one security blocklist and has been blocked by PhishDestroy. VirusTotal scans report that 7 of 95 antivirus and URL‑reputation engines flag the domain as malicious, reinforcing the suspicion of malicious intent. The Gridinsoft trust score of 0 / 100 further reflects a high‑risk assessment. Because the site is offline, active probing is limited, and no additional content or certificate details can be collected.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurrection of the host, and add the IP address 91.92.241.15 to deny lists. Correlation with other observed Coinbase‑impersonation campaigns is advised, as the same hosting infrastructure may be reused. Logging of DNS queries for this domain and alerting on future resolution attempts will help detect re‑use. Given the concrete evidence of brand impersonation, malicious hosting, and multiple vendor detections, the domain should be treated as a confirmed crypto‑scam threat.