coinbasecommerceesupport[.]com

The domain coinbasecommerceesupport.com has been identified as a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. This domain is currently marked as taken down, though prior activity suggests it was actively used for malicious purposes. The threat type is classified as brand impersonation, designed to deceive users into believing they are interacting with legitimate Coinbase support or commerce-related services. Analysis of the domain reveals multiple technical indicators of compromise. The domain was flagged by 14 of 95 security vendors on VirusTotal, indicating broad recognition of its malicious nature. It was registered on October 18, 2025, through OwnRegistrar, Inc., and resolves to the IP address 188.114.97.3, hosted on infrastructure belonging to AS13335 Cloudflare, Inc. in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend a false sense of legitimacy. The domain appears on at least one security blocklist and was explicitly blocked by PhishDestroy. The page title displayed to victims was 'Account Suspended,' a social engineering tactic intended to create urgency and prompt users into divulging sensitive information. The current status of the domain is taken down, reducing immediate risk to end users. However, the infrastructure and registration patterns observed may indicate a broader campaign. Organizations and individuals are advised to monitor for similar domains registered through OwnRegistrar, Inc., or resolving to Cloudflare-hosted IPs with recent creation dates. Users should verify the legitimacy of any communication claiming to be from Coinbase by cross-referencing official domains and avoiding interaction with unsolicited links or messages. Security teams are recommended to update blocklists with this domain and its associated indicators, including the IP address 188.114.97.3, to prevent future access attempts.