catcoinbase[.]aquila[.]it

On 22 July 2026 the domain catcoinbase.aquila.it was observed as part of a brand‑impersonation campaign targeting Coinbase users. The site presented the page title “catcoinbase.aquila.it”, matching the domain name, and was classified as a crypto‑scam. DNS resolution points to the IP address 139.162.181.76, which belongs to AS63949 (Akamai Connected Cloud) and is geolocated in Germany. The authoritative name servers are lunlun.ns.giantpanda.com and yangyang.ns.giantpanda.com, both associated with the Giant Panda DNS service.

No TLS certificate was found, meaning the site was served over plain HTTP, a typical characteristic of low‑cost phishing infrastructure. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans recorded four detections out of ninety‑five scanners, confirming that multiple security vendors have flagged the domain as malicious. The campaign’s risk rating is elevated, and the infrastructure has been taken offline at the time of reporting.

Open questions remain regarding the exact content served before takedown, the registration details of the domain, and any additional hosting or command‑and‑control infrastructure that may have been used. No evidence of Safe Browsing or Open Threat Exchange listings was provided. Defenders should add catcoinbase.aquila.it to internal block lists, monitor the associated IP range (139.162.181.0/24) for further activity, and enforce HTTPS‑only policies to reduce exposure to similar domains lacking TLS. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators, and users should be reminded not to enter Coinbase credentials on untrusted sites.