coinbase[.]refund[.]ooo

This domain, coinbase.refund.ooo, is flagged as an active cryptocurrency scam impersonating Coinbase, a major cryptocurrency exchange platform. Analysis indicates the domain was registered on April 2, 2025, through Porkbun LLC, and remains operational as of July 12, 2026. Infrastructure analysis reveals the domain resolves to IP address 51.77.45.158, hosted on OVH SAS infrastructure (AS16276) in Poland. The site employs a Let's Encrypt SSL certificate (serial E7), which while providing encryption, does not validate legitimacy. A 403 HTTP status suggests the server is configured to restrict access, potentially to evade detection or limit exposure during setup phases. The domain is associated with four nameservers under Porkbun (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, salvador.ns.porkbun.com), a pattern consistent with domains registered for short-term malicious campaigns. Detection engines on VirusTotal flag the domain, with 9 out of 95 security vendors identifying it as malicious. While the exact content of the site has not been analyzed, the page title 'refund.ooo' and known brand impersonation of Coinbase align with common tactics used in cryptocurrency refund scams, where victims are tricked into believing they are interacting with legitimate refund or recovery processes. Defenders should treat this domain as high-risk. The domain appears on at least one security blocklist and has been flagged by PhishDestroy. Organizations are advised to block resolution to the IP 51.77.45.158 and monitor for any attempts to access coinbase.refund.ooo within their networks. Given the domain's registration age and continued activity, it is likely part of an ongoing campaign targeting users of cryptocurrency platforms. Additional scrutiny of domains registered through the same registrar or utilizing similar naming conventions (e.g., 'refund' subdomains) may help identify related threats.