cooinbasse[.]com

Analysis of the domain cooinbasse.com, created on 14 March 2026 and registered through Gname.com Pte. Ltd., shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The site resolves to the IPv4 address 103.108.41.18, which is advertised as being located in Hong Kong and belongs to ASN 135581 (ONL‑HK). The authoritative nameservers are ns1.dns.com and ns2.dns.com, which are commonly used by transient phishing infrastructure. The domain is served over HTTPS using a Let’s Encrypt R12 certificate, indicating that a valid TLS handshake can be established despite the malicious intent.

Public threat‑intelligence feeds list the domain on three security blocklists and it is actively blocked by PhishDestroy, MetaMask and SEAL, suggesting that multiple defensive platforms have observed abuse. The presence on three independent blocklists further corroborates the malicious nature. VirusTotal reports that 12 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity. Google Safe Browsing classifies the URL as a social‑engineering threat, consistent with the “Airdrop Scam” phishing kit attributed to the infrastructure.

The HTTP response returned a “404 Not Found” page title, which may be a placeholder after takedown, and no further page content was captured. Although the domain is currently offline, defenders should continue to monitor for re‑registration or related domains, enforce blocklist updates, and educate Coinbase users about unsolicited airdrop requests. Attribution is limited to the observed technical artifacts; no additional payload or credential‑harvesting pages have been publicly disclosed.