crypto-coinbase[.]es

The domain crypto-coinbase.es is currently flagged as a high‑risk brand‑impersonation site targeting Coinbase users. Technical analysis shows that the domain resolves to the IPv4 address 84.32.84.32, which belongs to AS47583 Hostinger International Limited and is geolocated in Lithuania. The authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com, both of which are typical of parked domains on the Hostinger DNS platform. The HTTP response presents the page title "Parked Domain name on Hostinger DNS system" and there is no TLS certificate associated with the host, indicating that the site is reachable only over plain HTTP.

Google Safe Browsing has classified the domain under the social engineering category, and VirusTotal reports that 10 of 95 scanning engines have identified the domain as malicious. The domain appears on a single external security blocklist and has been explicitly blocked by the PhishDestroy service. The site’s current operational status is recorded as offline, which may be the result of takedown actions or temporary hosting changes.

While the available intelligence confirms the domain’s association with a crypto‑scam and its impersonation of the Coinbase brand, several details remain unverified: the exact HTTP status code returned, the registrar information, and any observed malicious payloads or credential‑harvesting pages. Defenders should prioritize adding crypto-coinbase.es to internal DNS and proxy blocklists, enforce TLS inspection to capture any future unencrypted traffic, and monitor for re‑registration attempts. Continuous correlation with threat‑intel feeds for any resurgence of the domain or related infrastructure is recommended to maintain proactive protection against potential brand‑spoofing campaigns.