etape-coinbase[.]com

The domain etape-coinbase.com has been identified as a brand impersonation threat specifically targeting Coinbase, a well-known cryptocurrency exchange platform. This domain was registered on August 03, 2025, through OwnRegistrar, Inc., and resolves to the IP address 91.212.166.216. Analysis by PhishDestroy reveals that the domain is currently offline and returns a 404 page title, indicating it may have been taken down after detection. However, the risk remains for users who may have encountered it while active, as it was designed to deceive visitors into believing they were accessing legitimate Coinbase services.

Technical indicators show that etape-coinbase.com has a VirusTotal score of 5 out of 95 security vendors flagging it as malicious, and it appears on one security blocklist. The domain does not have an SSL certificate, which is unusual for legitimate financial services and further underscores its fraudulent nature. The registrar, OwnRegistrar, Inc., is known for hosting suspicious domains, and the creation date so close to the present suggests a short-lived campaign designed to evade detection. Google Safe Browsing status was not explicitly provided, but the presence on blocklists and vendor flags indicates probable blacklisting.

Currently, the domain is offline, which suggests that hosting providers or registrars may have taken action in response to reports. PhishDestroy recommends that users who have interacted with etape-coinbase.com should monitor their accounts for unauthorized access, change passwords if credentials were entered, and enable two-factor authentication on their Coinbase accounts. While the immediate threat is mitigated by the domain's offline status, similar domains may appear under different names, so vigilance is advised. Users are encouraged to report any suspicious Coinbase-related domains to the platform's security team and to always verify URLs before entering sensitive information.