fak52kfafma[.]com

As of July 23, 2026, the domain fak52kfafma.com has been confirmed as a Coinbase impersonation scam. This domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on December 21, 2025, and has since been taken offline. The domain resolved to the IP address 172.67.168.140, which is located in the United States and is part of Cloudflare, Inc.'s Autonomous System (AS13335). The site did not use an SSL certificate, which is a common indicator of phishing infrastructure.

The domain has been blocked by PhishDestroy, a reputable security service, and has been flagged by 16 of 93 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, indicating a high level of suspicion and potential threat to users. The Gridinsoft trust score of 0/100 further corroborates the malicious nature of this domain. The page title found was 'Coinbase - Sign In,' which suggests the domain was designed to mimic the Coinbase login page, likely to steal user credentials or other sensitive information.

Given the elevated risk level and the specific targeting of Coinbase, security teams and users should be vigilant and avoid visiting this domain. Defenders should also ensure that their network and endpoint security solutions are updated to block this domain and any related phishing activities. While the domain is currently offline, the infrastructure and registration details suggest a deliberate attempt to deceive users and compromise their accounts, particularly in the context of crypto scams.