wallet[.]coinbase[.]perforationsplus[.]com

This domain, wallet.coinbase.perforationsplus.com, is flagged as an active brand impersonation threat targeting Coinbase, a well-known cryptocurrency exchange. Infrastructure analysis reveals the domain was registered on September 11, 2020, through ENOM, INC., and currently resolves to IP address 50.6.230.37, hosted on AS31898 (Oracle Corporation) in the United States. The domain uses nameservers ns61.onlinemountain.com and ns62.onlinemountain.com, which have been associated with other fraudulent activities in prior cases. A Let's Encrypt SSL certificate (R13) is present, providing a false sense of legitimacy to potential victims. The page title, 'Wallet Coinbase Wallet,' explicitly mimics Coinbase's branding, reinforcing the likelihood of a crypto-focused scam. The domain is classified as a crypto scam in threat intelligence feeds, though the exact mechanics of the fraud (e.g., credential harvesting, fake wallet software, or token drainer) remain unconfirmed due to the absence of on-page analysis. A 307 HTTP redirect status suggests the site may be funneling visitors to another malicious endpoint, though the destination is not yet identified. Defenders should note that 12 of 95 security vendors on VirusTotal have flagged this domain, and it appears on at least one security blocklist (PhishDestroy). The domain's trust score from Gridinsoft is 0/100, further indicating high-risk infrastructure. Given the domain's age, persistent activity, and association with known fraudulent nameservers, it is likely part of a larger, ongoing campaign. Immediate action is recommended, including blocking the domain and IP at the network level, monitoring for related subdomains or IPs, and alerting users to avoid interaction with any content hosted under this domain. Further investigation into the redirect chain and any associated cryptocurrency addresses is advised to disrupt potential financial flows.