485013-coinbaseportal[.]com

On 23 July 2026, the domain 485013-coinbaseportal.com was observed to be offline but retained in multiple threat intelligence feeds. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to the IPv4 address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative name servers are gwen.ns.cloudflare.com and rory.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was presented when the host was queried, suggesting the site was served over plain HTTP or that the certificate was deliberately omitted.

VirusTotal records show that seven of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious activity. The site appeared on a single public blocklist and was explicitly blocked by the PhishDestroy service. Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence in its malicious nature. The only visible page element captured during the brief crawl was the title “Just a moment…”, which provides no functional context and is consistent with a placeholder page often used in compromised or takedown‑ready sites. The domain’s naming pattern incorporates the legitimate brand “coinbase”, and the intelligence tags it as a crypto‑related scam that impersonates the Coinbase brand.

No further technical artifacts such as phishing kits, credential‑harvesting forms, or malicious payloads have been disclosed, and the exact content of the site remains unverified. Consequently, analysts cannot confirm the specific attack vector or the presence of credential‑stealing mechanisms. Defenders should add 485013-coinbaseportal.com to local and network‑level blocklists, monitor traffic to the associated IP address 188.114.97.3 for any residual connections, and maintain vigilance for newly registered domains that combine numeric prefixes with the “coinbaseportal” suffix.