coinbasecryptoblizt[.]digital

coinbasecryptoblizt.digital was observed resolving to the Amazon Web Services address 63.176.8.218 located in Germany (AS16509). The domain is registered through Name.com, Inc., and uses the DNS infrastructure of NS1 (dns1.p04.nsone.net through dns4.p04.nsone.net). A DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate is presented, indicating a valid TLS chain but offering no credibility for the content. The site returned HTTP 404, and the page title reported by scanners is “Crypto Blizt”, which aligns with the classified scam type “Crypto Scam”.

Google Safe Browsing flagged the domain for social engineering, and 13 of 95 VirusTotal scanners labeled it malicious, suggesting a consensus among security vendors that the site is used for credential or asset theft. The domain impersonates Coinbase, a high‑value financial brand, and is listed on at least one public blocklist, with PhishDestroy confirming its takedown. Current status is offline, but the infrastructure—particularly the AWS‑hosted IP and the NSOne name servers—remains reusable for future campaigns.

Uncertainty remains regarding the exact payload or phishing page content, as only the HTTP 404 response and title have been captured. Defenders should continue to block the domain and associated IP, monitor the NSOne name servers for new subdomains, and update detection rules to flag any future resolutions to 63.176.8.218 that reference Coinbase or cryptocurrency‑related keywords. Incident response teams should also consider hunting for artifacts of credential harvesting attempts that may have been directed at Coinbase users during the brief live window.