sales-batch[.]coinbase[.]com[.]lc

sales-batch.coinbase.com.lc is currently flagged as a high‑risk brand‑impersonation site targeting Coinbase customers. The domain resolves to the IPv4 address 75.2.18.233 and is hosted within Amazon’s AS16509 network in the United States. An analysis of the TLS certificate shows a valid Let’s Encrypt R13 certificate, and the web server advertises Nginx and OpenResty. HTTP requests return a 200 status code, indicating an active web service.

Security telemetry reports that ten of ninety‑five VirusTotal scanners have marked the domain as malicious, while Google Safe Browsing classifies it under the SOCIAL_ENGINEERING category. The Gridinsoft trust score is 0 out of 100, and the domain appears on one external blocklist. Registration metadata points to the AMAZO‑4 registrar, reinforcing the association with ASN 16509. PhishDestroy has already added the domain to its blocklist, confirming that defensive operators have recognized its malicious intent.

The available intelligence does not include a visual or content analysis of the landing page beyond the title “sales‑batch.coinbase.com.lc,” nor does it reveal the exact payload or credential‑collection mechanism employed. Consequently, the precise tactics used to lure victims—whether login harvesters, crypto‑wallet prompts, or other fraud vectors—remain unconfirmed. Continuous monitoring of the host infrastructure and any associated DNS records is advisable to detect potential shifts in activity.

Defenders should immediately block the domain name and its resolved IP address at perimeter firewalls and DNS filtering layers. Inclusion of the IPv4 host in threat‑intelligence feeds and endpoint allow‑list exclusions will prevent inadvertent access. Organizations should alert users to the specific impersonation of Coinbase and advise verification of URLs before entering any account information. Reporting the indicator to additional malware‑tracking platforms will aid in broader community mitigation.