coinbaseai[.]one

Analysis as of July 25 2026 indicates that the domain coinbaseai.one is actively leveraged for a cryptocurrency‑related brand impersonation campaign targeting users of Coinbase. The domain was registered on 21 November 2025 through Dynadot LLC, a registrar commonly used by malicious actors. No SSL certificate is present, meaning the site served only HTTP or was inaccessible, which aligns with its current offline status. DNS resolution points to 172.67.207.168, an IP owned by Cloudflare (AS13335) located in the United States, suggesting the operator is using Cloudflare’s CDN to hide the true backend infrastructure. The authoritative nameservers are sara.ns.cloudflare.com and troy.ns.cloudflare.com, further confirming reliance on Cloudflare’s DNS services.

The page title returned from the HTTP response is simply “coinbase”, providing minimal evidence of brand impersonation but matching the declared target. VirusTotal has recorded 15 detections out of 95 scanned engines, indicating that a significant portion of security vendors flag the domain as malicious. The domain appears on two public blocklists and is explicitly blocked by the PhishDestroy and ScamSniffer filtering services, reinforcing its classification as a crypto scam. Trust‑rating services assign extremely low scores: Gridinsoft rates the domain 0/100 and Scamadviser 20/100, both well below acceptable thresholds. Because the site is currently offline, content‑level analysis (e.g., HTML forms, credential‑stealing payloads) cannot be confirmed, and the exact phishing kit or credential‑capture mechanism remains unknown.

Nonetheless, the combination of registrar choice, Cloudflare hosting, lack of TLS, low trust scores, and multiple vendor detections provides sufficient confidence to treat coinbaseai.one as a high‑risk impersonation vector. Defenders should add coinbaseai.