coinbasesupportinfo[.]com

Analysis indicates that coinbasesupportinfo.com is a newly registered domain used to impersonate Coinbase, a well-known cryptocurrency exchange. The domain was created on March 03, 2026 and registered through GoDaddy.com, LLC. It is configured with GoDaddy's default nameservers ns19.domaincontrol.com and ns20.domaincontrol.com, and resolves to the IP address 76.223.105.230, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. No SSL certificate is present, meaning the site does not serve traffic over HTTPS. The page title returned by the server is the literal domain name, coinbasesupportinfo.com, providing no additional context about the content hosted.

VirusTotal scans have recorded detections from four of ninety‑five security vendors, suggesting that at least some scanners recognize malicious characteristics. The domain is listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of malicious intent. Current operational status is offline, indicating that the site may have been taken down or is temporarily unavailable. Uncertainty remains regarding the exact payload or phishing page content because no visual or HTML analysis is available, and the lack of an SSL certificate prevents verification of secure communications.

Defenders should add the domain and its associated IP address to network denylists, monitor for any resurgence of activity, and enforce strict email and web filtering policies that flag unsolicited communications referencing Coinbase support. Users should be reminded that Coinbase does not use domains outside of its official set of URLs and that any request for credentials or cryptocurrency transfers from an unknown domain should be treated as suspicious. Continuous observation of the hosting provider's IP range for similar registrations is recommended to detect potential campaign expansion.