coinbas[.]es

The domain coinbas.es is currently active and classified as a high‑risk brand‑impersonation campaign targeting Coinbase. Registration data shows the domain was created on 2026-06-03. DNS resolution points to IP address 185.253.212.22, which is registered to Michau Enterprises Limited in Poland. The host presents a valid Let's Encrypt certificate (R13) and returns HTTP 200 for default requests. Infrastructure analysis indicates the domain appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. Reputation scoring from Gridinsoft assigns a 0/100 trust rating. VirusTotal analysis reports that 7 of 91 scanned security vendors flag the domain as malicious. AlienVault OTX lists the domain in four separate threat intelligence pulses. While the site content has not been directly examined, the convergence of blocklist presence, low trust score, multiple vendor detections, and explicit impersonation of Coinbase suggests a coordinated phishing effort. Defenders should block outbound connections to 185.253.212.22, add coinbas.es to local deny lists, monitor for related C2 activity, and educate users about the fraudulent Coinbase branding. Continuous monitoring is advised to detect any changes in hosting or payload delivery.