837485coinbase[.]com

This domain, 837485coinbase.com, is identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. The site presents itself as an official Coinbase support portal, using the page title 'Coinbase - Enter Case ID' to deceive users into submitting sensitive information, likely for credential theft or account takeover purposes. No evidence of a crypto drainer kit was observed, but the impersonation tactics align with credential harvesting campaigns commonly deployed against financial service users.

Technical indicators confirm the malicious nature of this domain. It is registered through Hello Internet Corp and lacks an SSL certificate, increasing exposure to interception risks. The domain resolves to IP address 172.67.208.112, hosted on Cloudflare infrastructure (AS13335), a common obfuscation tactic. Created on February 21, 2026, the domain appears recently established for malicious purposes. Google Safe Browsing explicitly flags it as phishing, and it is listed on three security blocklists. VirusTotal detection rates show 21 out of 95 security vendors marking the domain as malicious, further validating its threat status.

As of the latest assessment, 837485coinbase.com has been taken offline, reducing immediate risk to users. However, the domain remains registered, and similar infrastructure could be reactivated or repurposed. Response actions include blocking by multiple security providers, but users should remain vigilant. Any prior interaction with this domain warrants immediate credential rotation, particularly for Coinbase accounts. Organizations should monitor for related domains using the same registrar or IP range, as threat actors often reuse infrastructure across campaigns.