web[.]coinbases-ut[.]top

Analysis of web.coinbases-ut.top confirms it as a crypto-focused phishing domain targeting Coinbase users. The domain, registered on February 21, 2026, through Gname.com Pte. Ltd., was taken offline by July 23, 2026, but infrastructure evidence remains actionable. The page title explicitly displayed 'Coinbase,' aligning with the reported scam type (Crypto Scam) and brand impersonation. No SSL certificate was present, a common red flag for fraudulent sites, and the domain resolved to IP 172.67.188.94, hosted on Cloudflare's network (AS13335, US).

Nameservers (anirban.ns.cloudflare.com, fiona.ns.cloudflare.com) further link it to Cloudflare, a frequent choice for threat actors due to its proxy services. Detection data reinforces its malicious classification: 12 of 93 security vendors on VirusTotal flagged the domain, and it appears on at least one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, indicating high confidence in its fraudulent nature.

While the exact content of the site is not analyzed, the combination of brand impersonation, crypto scam classification, and detection by multiple vendors confirms its intent to deceive users. Defenders should treat this domain as a confirmed phishing asset, block it at DNS and proxy levels, and monitor for related infrastructure (e.g., shared IPs, nameservers, or registrar patterns). The absence of SSL and use of Cloudflare proxy services are notable infrastructure choices that align with known phishing tactics.