coinbasesupports[.]net

The domain coinbasesupports.net was registered on February 28, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which is hosted by Cloudflare (AS13335) in the United States. No SSL certificate is presented for the site, and an HTTP request returns the page title "Site Under Maitenance". The domain is currently taken offline, but it was previously listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis shows that six of ninety‑three security vendors flagged the domain as malicious, reinforcing the suspicion that it was used for a cryptocurrency‑related scam targeting Coinbase users. The nameservers phoenix.ns.cloudflare.com and yahir.ns.cloudflare.com are both Cloudflare‑controlled, indicating the attacker leveraged Cloudflare’s DNS services to hide its true infrastructure. While the site is no longer reachable, the presence of the domain on multiple blocklists, the detection count on VirusTotal, and the explicit branding of Coinbase as the impersonated target suggest a deliberate brand‑impersonation campaign aimed at extracting crypto assets from unsuspecting victims.

Defenders should continue to block coinbasesupports.net at the network perimeter, add the associated IP 188.114.97.3 to deny‑list rules, and monitor for new domains that resolve to the same Cloudflare nameservers or share the same registration pattern. Threat‑intel teams should also correlate any future alerts that reference the page title "Site Under Maitenance" or the same set of blocklists, as these indicators may reappear in related campaigns.