pop[.]coinbasexnfts[.]com

This report analyzes the domain pop.coinbasexnfts.com. The page title "about:privatebrowsing" indicates no visible content was loaded or it was accessed in a private session. The domain impersonates the Coinbase brand and is classified as a cryptocurrency scam. The threat is a social engineering attack designed to deceive users into believing they are interacting with a legitimate Coinbase service, likely to steal credentials or cryptocurrency assets.

Technical evidence shows VirusTotal detected the domain as malicious by 13 out of 95 security vendors. It is flagged by ADMINUSLabs, ChainPatrol, BitDefender, CRDF, and CyRadar. Google Safe Browsing flags it for SOCIAL_ENGINEERING. The domain is on one blocklist. It was registered with Global Domain Group LLC and created on 2026-02-21. The IP address 198.251.88.32 is located in the United States, hosted by AS53667 FranTech Solutions. No SSL certificate was detected. Nameservers include ns107.asurahosting.com and ns107.my-control-panel.com.

The domain is currently down or offline. The risk level is high due to confirmed malware and social engineering flags from multiple security vendors, active impersonation of Coinbase, and the lack of SSL security. Users should avoid any interaction with this domain.