453441-coinbase[.]com

The domain 453441-coinbase.com has been identified as a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis confirms the domain was designed to deceive users into believing they are interacting with legitimate Coinbase services, likely for credential theft or fraudulent transactions. As of the latest assessment, the domain is currently offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on December 07, 2025, an unusually future-dated creation that may indicate an attempt to evade immediate detection. The domain resolves to the IP address 172.67.208.96, hosted under AS13335 (Cloudflare, Inc.) in the United States, a common tactic to obscure origin infrastructure. Detection metrics indicate 18 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on at least one security blocklist. Notably, the domain lacks an SSL certificate, further reducing its legitimacy. The page title, '453441-coinbase.com | 502: Bad gateway,' suggests either a failed deployment or deliberate misconfiguration to avoid automated analysis. Given the domain's current offline status, immediate active threats are mitigated; however, historical exposure remains a risk for users who may have interacted with it prior to takedown. Security teams are advised to monitor for residual redirects or cached versions in web archives. Organizations should proactively block the domain and associated IP (172.67.208.96) at the network level, while users should verify all communications via official Coinbase channels. Future registrations under similar naming conventions (e.g., numeric prefixes or brand suffixes) should be treated with heightened scrutiny, particularly those registered through NiceNIC or leveraging Cloudflare hosting.