login[.]coinbasefinancedepartment[.]com

The domain login.coinbasefinancedepartment.com was registered on June 11, 2025 and continues to resolve to the IP address 75.2.115.196, which is owned by AS16509 in the United States. The authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net. An HTTPS endpoint is present, secured with a publicly trusted certificate issued by Let’s Encrypt. The site returns HTTP 200 and presents the page title "coinbasefinancedepartment.com", matching the brand target Coinbase and indicating a cryptocurrency‑related impersonation campaign. VirusTotal records show that 14 of 95 scanning engines have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on at least one security blocklist and is currently blocked by the PhishDestroy feed. Infrastructure analysis reveals that the host resides on a cloud provider network, a common choice for short‑lived phishing sites. While the exact content of the landing page has not been publicly disclosed, the collected indicators confirm active brand‑impersonation activity. Defenders should add the domain and its IP address to network blocklists, monitor DNS queries for the domain, and enforce TLS inspection where feasible to detect potential credential capture attempts. Ongoing observation is recommended to capture any changes in hosting or additional payload delivery mechanisms.