app[.]coinbasekorea[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Coinbase users. Analysis indicates the site is designed to deceive visitors into believing they are interacting with the legitimate Coinbase platform, specifically through a fraudulent page titled "Coinbase TOKEN." The objective is likely to facilitate cryptocurrency theft by tricking users into disclosing credentials or transferring assets to attacker-controlled wallets.

Infrastructure analysis reveals the domain was registered through Dynadot Inc on April 07, 2026, and resolves to the IP address 203.248.94.172. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy. Security vendor detection on VirusTotal stands at 19/95, with the domain appearing on two security blocklists. It is also blocked by MetaMask and SEAL, further confirming its malicious nature. The Gridinsoft trust score for this domain is 0/100, indicating no credibility. The domain is currently offline, but historical activity suggests it was operational long enough to pose a significant risk.

To mitigate the threat posed by this brand impersonation domain, organizations should immediately block the domain and its associated IP (203.248.94.172) at the network perimeter. Endpoint protection systems should be updated to flag any attempts to access the domain. Users who may have interacted with the site should be instructed to revoke any active sessions, reset credentials, and monitor their cryptocurrency wallets for unauthorized transactions. Security teams should conduct a retrospective analysis to identify any prior connections to the domain or IP within network logs. Additionally, domain monitoring tools should be configured to alert on newly registered domains containing "coinbase" or similar variations to preempt future impersonation attempts.