72351coinbase[.]com

Analysis indicates that the domain 72351coinbase.com was registered through Ultahost, Inc. on 11 June 2026. The domain resolves to the IP address 104.21.83.214, an address currently associated with multiple malicious hosting activities. Reputation checks reveal that the domain is listed on three independent security blocklists, and it has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports five of ninety‑one scanning engines flag the domain as malicious, providing additional corroboration of its threat potential. The available intelligence classifies the site as a generic phishing platform, suggesting it is likely used to harvest credentials or financial information by luring victims with a counterfeit Coinbase‑related lure.

No public SSL certificate details, HTTP response codes, page titles, or content snapshots have been released, leaving the exact content of the landing page unverified. Likewise, there are no records of associated malware kits, autonomous system numbers, or geographic attribution beyond the hosting IP. Defenders should prioritize immediate containment measures. Network‑level controls ought to block DNS resolution and HTTP/HTTPS traffic to 104.21.83.214 and to the domain name itself.

Endpoint security solutions can incorporate the five VirusTotal detections to trigger alerts on any attempted connections. Continuous monitoring of the IP address for new vector activity is advisable, as the hosting provider may serve additional malicious domains. Where possible, sinkholing the domain or feeding it to a threat‑intel sharing platform will reduce exposure for downstream organizations. Until further forensic analysis of the site content is available, the domain remains an elevated‑risk indicator that should be treated as actively malicious.