localtmp[.]coinbase[.]earth

The domain localtmp.coinbase.earth was registered on October 26, 2024 through Porkbun LLC and is currently taken offline. Its authoritative nameservers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador.ns.porkbun.com. The site resolves to the IP address 199.59.243.228, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. No SSL certificate is presented for the domain, indicating that the site was served over plain HTTP.

The page title observed in prior scans is "coinbase.earth," and the domain is classified as a Crypto Scam that impersonates the Coinbase brand. VirusTotal analysis shows that three of ninety‑five security vendors flagged the domain as malicious. Independent security platforms have recorded a Gridinsoft trust score of zero out of one hundred and have listed the domain on one security blocklist. The domain is also blocked by the PhishDestroy service.

Although the site is no longer reachable, the existing evidence confirms that the infrastructure was deliberately provisioned to mimic Coinbase and to lure victims into a cryptocurrency‑related fraud. Defenders should continue to block the IP address 199.59.243.228, add the domain and its associated nameservers to URL filtering rules, and monitor for any re‑registration attempts. Because the site lacks TLS, any future activation would be easily detectable by TLS inspection. Further investigation is needed to determine whether additional infrastructure, such as command‑and‑control servers or credential‑harvesting endpoints, were associated with this domain before it was taken offline.