coiubase[.]com

This domain, coiubase.com, is a confirmed phishing site targeting Coinbase users. Registered on December 15, 2025, through NameCheap, Inc., the domain resolves to IP address 104.21.17.251, which is hosted by Cloudflare, Inc. in the United States (AS13335). The domain lacks an SSL certificate, a common trait of malicious sites that fail to secure communications. Security analysis shows strong indicators of malicious intent: 16 of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist.

Google Safe Browsing specifically flags the domain for social engineering, and Gridinsoft assigns a trust score of 0 out of 100, indicating high distrust. AlienVault OTX includes the domain in one threat intelligence pulse, confirming its presence in monitored threat actor campaigns. The domain is classified as a crypto scam, aligning with the impersonation of Coinbase, a legitimate cryptocurrency exchange. The site is now offline, and PhishDestroy has blocked the domain, preventing further victim access.

The nameservers roxy.ns.cloudflare.com and toby.ns.cloudflare.com indicate Cloudflare's DNS infrastructure, which may have been used to obscure the true hosting origin. Defenders should ensure that any historical network logs from the period when the domain was active—from its creation date until its takedown—are reviewed for connections to this IP or domain. Any credentials or cryptocurrency wallet addresses entered on this site should be considered compromised, and affected users should be alerted to change passwords and enable two-factor authentication on legitimate Coinbase accounts. The exact content served on the site was not captured in available intelligence, so the full scope of data collected by attackers remains uncertain.