b19917coinbase[.]com

b19917coinbase.com was registered on 15 November 2025 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 142.250.185.228, which belongs to AS15169 Google LLC and is geolocated in the United States. DNS delegation points to dina.ns.cloudflare.com and stanley.ns.cloudflare.com, indicating use of Cloudflare name servers. No TLS certificate is presented, so connections are unencrypted. The HTTP response returned a page with the title “Google”, which does not correspond to any legitimate Coinbase service.

The site is catalogued as a crypto‑related scam that impersonates the Coinbase brand. Independent analysis by Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on at least one security blocklist. PhishDestroy has already taken the domain offline. VirusTotal scans show that 13 of 95 antivirus and URL‑filtering engines flagged the domain as malicious. The combination of a recent registration, use of reputable hosting infrastructure, lack of SSL, and the presence of a generic “Google” title suggests a low‑effort impersonation campaign rather than a sophisticated credential‑harvesting portal.

Uncertainty remains regarding the exact payload or credential‑collection mechanisms, as the site content has not been captured. Defenders should block the domain at network perimeter and DNS layers, monitor for newly registered domains that share the “coinbase.com” suffix pattern, and update detection signatures with the observed resolver IP and Cloudflare name servers. Because the domain is already offline, incident response teams can treat any observed traffic to the IP as likely malicious and isolate affected hosts. Ongoing threat‑intel feeds should be consulted for any resurgence of similar infrastructure.