118924-coinbase[.]com

This domain, 118924-coinbase.com, was observed hosting a page titled “Coinbase - Sign In”. The domain resolves to IP address 104.21.80.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate was presented, indicating the site was served over plain HTTP or an invalid HTTPS configuration. Registration data shows the domain was created on 9 January 2025 and was registered through NiceNIC International Group Co., Limited. The nameservers listed are amalia.ns.cloudflare.com and arvind.ns.cloudflare.com, both belonging to Cloudflare’s DNS service.

VirusTotal recorded 19 detections out of 95 scanned security vendors, and Google Safe Browsing classifies the URL as a social‑engineering threat. The site appears on a single external blocklist and has been flagged by PhishDestroy, which subsequently took the domain offline. AlienVault OTX references the domain in 18 threat‑intel pulses, reinforcing its association with malicious activity. Scamadviser assigns a trust score of 1 / 100, and the listed scam type is “Crypto Scam”, indicating an attempt to lure victims into exposing cryptocurrency credentials. While the page title suggests a credential‑capture motive targeting Coinbase users, no additional content analysis is available.

The lack of an SSL certificate and the reliance on Cloudflare infrastructure are typical of fast‑flux or temporary phishing deployments. Defenders should continue to block the domain at DNS and web‑filter layers, monitor for any resurgence of the same sub‑domain pattern, and enforce multi‑factor authentication for Coinbase accounts. Incident response teams should treat any login attempts originating from this host as compromised and advise affected users to change passwords and revoke any API keys. Ongoing threat‑intel feeds should be consulted for new indicators that may link this infrastructure to broader crypto‑draining campaigns.