coinbase-recive[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site mimics transaction receipts under the guise of "Coinbase Commerce," a tactic commonly employed to deceive users into disclosing sensitive credentials or authorizing fraudulent transactions. The threat type aligns with known patterns of cryptocurrency-related fraud, where attackers exploit trust in legitimate brands to facilitate unauthorized access to wallets or accounts. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.54.233 and was registered through MAT BAO CORPORATION on May 27, 2026. It appears on 3 security blocklists and is flagged by 6 out of 95 security vendors on VirusTotal. AlienVault OTX records the domain in 2 threat intelligence pulses, further corroborating its malicious classification. Detected technologies include Node.js, Vue.js, Nuxt.js, and Cloudflare services, which are often leveraged to obfuscate malicious activity. The domain is currently offline, though its prior operational status and registration details remain concerning. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP (104.21.54.233) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to the domain, particularly for systems handling cryptocurrency transactions. Users who may have interacted with the site should be advised to revoke any active session tokens, reset credentials, and monitor accounts for unauthorized activity. Given the domain's impersonation of Coinbase Commerce receipts, additional scrutiny should be applied to any unexpected transaction confirmations or payment requests.