verifiycoinbase[.]com

This domain, verifiycoinbase.com, is identified as a brand impersonation phishing site targeting Coinbase, a cryptocurrency exchange platform. The domain is currently offline, but prior analysis confirms its malicious intent to deceive users into disclosing sensitive credentials or financial information under the guise of the legitimate Coinbase brand. The threat type is classified as brand impersonation, with no evidence of crypto drainer or fake login page functionality at the time of assessment, though the domain’s structure and naming convention strongly suggest credential harvesting objectives.

Infrastructure analysis reveals the domain was registered on August 09, 2025, through Name.com, Inc. It resolved to the IP address 34.111.179.208, hosted on Google LLC’s AS396982 in the United States. The domain was flagged by 15 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious classification. It appeared on one security blocklist, and no SSL certificate was present, further reducing its legitimacy. The page title, matching the domain name, reinforces its deceptive nature, as legitimate Coinbase pages use branded, user-friendly titles rather than raw domain strings.

At present, verifiycoinbase.com is offline, likely due to takedown efforts or abandonment by the threat actor. However, organizations and users are advised to treat this domain as a confirmed threat. Network-level blocking is recommended for all resolutions associated with this domain, including its known IP address. Users who may have interacted with the domain should reset credentials for Coinbase and any other accounts where identical passwords were reused. Monitoring for secondary domains using similar naming patterns (e.g., typosquatting variations of 'coinbase') is also advised, as threat actors frequently rotate infrastructure to evade detection.