njmndshare[.]coinbasefinancedepartment[.]art

This domain, njmndshare.coinbasefinancedepartment.art, is an active phishing infrastructure impersonating Coinbase, as indicated by its registration details and page title. Registered on June 28, 2025, through Dynadot LLC, the domain resolves to IP address 75.2.115.196 and is secured with a Let's Encrypt SSL certificate. Analysis reveals that the page title explicitly references 'coinbasefinancedepartment.art,' aligning with the brand impersonation threat type targeting Coinbase users. Security vendor assessments confirm malicious activity, with 9 of 95 engines on VirusTotal flagging the domain. The domain has been blocked by at least one security provider and holds a trust score of 0/100 from Gridinsoft, further supporting its classification as high-risk. While the exact content and functionality of the site remain unanalyzed, the combination of brand impersonation, recent registration, and detection by multiple security vendors indicates a deliberate phishing operation. Defenders should treat this domain as confirmed malicious infrastructure. Network-level blocking, endpoint protection updates, and user awareness campaigns are recommended to mitigate exposure. The domain remains active as of July 12, 2026, and continued monitoring is advised to track any shifts in hosting or additional indicators of compromise.