coinbaser[.]top

This domain, coinbaser.top, is identified as a high-risk brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into believing they are interacting with the legitimate Coinbase service, likely for credential harvesting or cryptocurrency theft. No specific drainer kit signatures have been confirmed, but the domain’s structure and SSL certificate patterns align with known phishing infrastructure targeting financial and crypto services. Technical indicators confirm the domain’s malicious intent. VirusTotal detection shows 19 out of 95 security vendors flagging coinbaser.top as malicious. The domain was registered through Gname.com Pte. Ltd. on March 27, 2026, and resolves to the IP address 143.92.40.204, hosted in Hong Kong under Rackip Consultancy Pte. LTD. The SSL certificate, issued by TrustAsia Technologies, Inc. under the LiteSSL RSA CA 2025 intermediate, follows a common pattern observed in phishing campaigns. The domain appears on three security blocklists and is actively blocked by at least three major security providers, including MetaMask and SEAL. As of the latest verification, coinbaser.top has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat due to the domain’s recent creation and the registrar’s history of hosting malicious domains. Users who may have interacted with the site should immediately revoke any active sessions, reset credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The remaining risk stems from the possibility of the threat actors re-deploying the domain or shifting to newly registered lookalike domains.