4rimehgfedcbasandbox[.]am[.]coinbase[.]cm

The domain 4rimehgfedcbasandbox.am.coinbase.cm has been identified as a brand impersonation threat specifically targeting Coinbase users. This domain is currently offline, but during its active period it posed significant risk to unsuspecting visitors by presenting a fraudulent page titled 'Coinbase Deutschland – Sicherer Kauf und Verkauf von Bitcoin, Ethereum und mehr'. The threat type is brand impersonation, designed to trick users into believing they are accessing the legitimate Coinbase platform, potentially leading to credential theft or financial loss.

Technical analysis reveals that this domain was created on May 12, 2025, and resolved to IP address 172.64.152.241. It was registered through Netcom.cm Sarl and lacks any SSL certificate, further indicating its illegitimate nature. VirusTotal flags show that 3 out of 95 security vendors have identified this domain as malicious, and it appears on one security blocklist. The domain's structure includes a subdomain mimicking Coinbase's sandbox environment, adding a layer of deceit to appear more trustworthy.

Currently, the domain is offline, meaning it is no longer accessible. However, users should remain vigilant as similar domains may reappear. PhishDestroy recommends that users never interact with unsolicited links claiming to be from Coinbase, always verify the official domain (coinbase.com), and utilize security tools to check domain reputations. If you have already entered credentials on such a site, change your passwords immediately and enable two-factor authentication.