defb0a5c-bb38-4e65-9bcb-ad608fd6a19a[.]coinbasemedia[.]com

PhishDestroy has identified an elevated-risk brand impersonation campaign targeting Coinbase customers. The domain defb0a5c-bb38-4e65-9bcb-ad608fd6a19a.coinbasemedia.com is a sophisticated attempt to steal credentials by mimicking the legitimate Coinbase brand. This specific threat type, known as brand impersonation phishing, often uses lookalike domains and fake login pages to trick users into revealing sensitive information.

This domain was registered on October 27, 2025 through Dynadot LLC and resolves to IP address 199.59.243.228. VirusTotal reports that 14 out of 95 security vendors flag this domain as malicious, and it appears on 1 security blocklist. The page title found was coinbasemedia.com, and no SSL certificate was detected, further indicating its fraudulent nature. The domain is currently offline, but similar threats may still be active.

To protect against Coinbase brand impersonation, users should always verify the URL before entering credentials, enable two-factor authentication, and avoid clicking links in unsolicited emails. Coinbase will never ask for passwords or sensitive information via email. If you encounter suspicious domains, report them to Coinbase's security team and your email provider. Stay vigilant and check the full report for more indicators.