172943-coinbase[.]com

Analysis of 172943-coinbase.com shows the domain was registered on 21 February 2026 and resolves to the Cloudflare‑owned address 185.158.133.1 located in Poland (AS13335). VirusTotal has recorded 13 positive detections out of 93 scanned engines, indicating that a minority of security products identify the site as malicious. The domain appears on a single public blocklist and has been specifically flagged by PhishDestroy as a crypto‑related impersonation of the Coinbase brand. The TLS certificate presented is identified as “WE1”, confirming that HTTPS is active, although the certificate details have not been linked to the legitimate Coinbase infrastructure.

The only visible page element captured is the title “Just a moment…”, which offers no further context about the payload or user‑facing content. The current operational status is listed as offline, and no additional evidence such as Safe Browsing verdicts, Open Threat Exchange tags, or registrar‑level reputation scores is available. Given the combination of brand impersonation, the Crypto Scam classification, and the observed detections, the domain should be treated as a high‑confidence malicious indicator. Defensive teams should add 172943-coinbase.com to URL filtering and DNS‑based blocklists, enforce outbound traffic restrictions to the associated IP address, and monitor for any future re‑use of the same IP range or similar domain patterns targeting Coinbase users.

Continuous re‑scanning of the domain, especially if it becomes active again, is advised to capture any changes in payload delivery or additional malicious indicators. Organizations that rely on Coinbase services should educate users to verify URLs and avoid entering credentials on sites that present generic titles such as “Just a moment…”. Because the site is presently offline, immediate impact is limited, but the infrastructure demonstrates a reusable Cloudflare foothold that could be leveraged for subsequent campaigns.