energypuc[.]xyz

Analysis of energypuc.xyz confirms its classification as a crypto scam site targeting Coinbase users, with infrastructure and detection patterns consistent with brand impersonation. The domain was registered on November 30, 2025, through NameCheap, Inc., a registrar frequently observed in phishing campaigns due to its accessibility and low-cost domain offerings. It resolves to the IP address 23.52.180.26, hosted on Akamai Technologies, Inc. (AS16625) in Germany, though the use of a content delivery network complicates attribution to a specific threat actor or hosting provider. Nameservers gene.ns.cloudflare.com and lakas.ns.cloudflare.com indicate Cloudflare protection, a common tactic to evade takedowns and obscure origin servers. The page title, 'Base: Formerly Coinbase Wallet App - App Store,' directly references Coinbase’s rebranded wallet service, suggesting an intent to deceive users into believing the site is an official or affiliated platform.

No SSL certificate was detected, which is atypical for legitimate financial services but aligns with low-effort scam operations. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, both of which specialize in identifying fraudulent crypto-related sites. VirusTotal reports flagged the domain by 2 of 95 security vendors, a modest detection rate that may reflect limited visibility or recent emergence. As of July 24, 2026, the domain is offline, though this status may be temporary.

Defenders should treat energypuc.xyz as a confirmed threat and prioritize blocking it at the DNS and network levels. Monitoring for re-registration or IP shifts is recommended, as the infrastructure (Cloudflare, Akamai) suggests potential for rapid redeployment. Organizations should also alert users to the risk of crypto scams impersonating Coinbase, particularly those leveraging rebranded services like Base.