627382-coinbase[.]com

The domain 627382-coinbase.com has been identified as a high-risk brand impersonation threat targeting the legitimate brand Coinbase. This domain is potentially being used for malicious activities that could deceive users into divulging sensitive information.

Technical indicators reveal that the domain was created on July 02, 2026. It has a VirusTotal detection score of 0/95, indicating it has not yet been flagged by any security services. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 108.165.185.40. Google Safe Browsing has flagged this domain for social engineering, highlighting its potential malicious intent. There are currently no entries in blocklists.

As of now, the domain remains active with a Let's Encrypt SSL certificate, suggesting an attempt to appear legitimate. Given the high-risk classification and the social engineering flag from Google Safe Browsing, immediate monitoring and mitigation actions are recommended to prevent user exploitation. Organizations should educate users on identifying similar fraudulent domains and implement security measures to block access to such threats.