948655coinbase[.]com

This domain, 948655coinbase.com, is identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. The domain is currently offline but was actively used to deceive users into believing they were accessing legitimate Coinbase services, specifically targeting German-speaking users as indicated by the page title 'Coinbase Deutschland – Sicherer Kauf und Verkauf von Bitcoin, Ethereum und mehr.' Analysis of the domain reveals multiple technical indicators of malicious activity. The domain was registered through NiceNIC International Group Co., Limited, on October 15, 2025, and resolved to the IP address 172.64.152.241, hosted on Cloudflare infrastructure (AS13335). No SSL certificate was detected, increasing the risk of unencrypted data transmission. The domain appears on one security blocklist and is flagged by 17 of 95 security vendors on VirusTotal. Google Safe Browsing has also classified this domain as phishing, further corroborating its malicious intent. The current status of 948655coinbase.com is offline, though historical activity suggests it was used for credential theft or fraudulent transactions. Organizations and users are advised to block this domain at the network level and monitor for any re-emergence under similar naming conventions. Users who may have interacted with this domain should immediately reset credentials for Coinbase and related financial accounts, enable multi-factor authentication, and review transaction histories for unauthorized activity. Security teams should correlate this domain with internal logs to identify potential compromise and update detection rules to include related infrastructure.