coinbasewebsafe[.]com

coinbasewebsafe.com is an active brand‑impersonation site targeting Coinbase. The domain was registered on 21 October 2025 through OwnRegistrar, Inc., and the current DNS configuration points to Cloudflare nameservers (ajay.ns.cloudflare.com, lovisa.ns.cloudflare.com). The host resolves to IP 172.67.216.157, which belongs to Cloudflare’s AS13335 in the United States. The site presents an SSL certificate issued by Google Trust Services under the WE1 identifier, but the web server returns HTTP 525, indicating an SSL handshake failure.

Cloudflare and HTTP/3 support are detected, but the failure suggests the service is either misconfigured or temporarily offline. Threat intelligence shows that 16 of 95 VirusTotal scanners have flagged the domain as malicious, and it appears on a single security blocklist that is actively enforced by PhishDestroy. AlienVault OTX has listed the domain in one pulse, and Gridinsoft assigns a trust score of 0 out of 100. The page title returned by the web server is “Index of /”, and no further content has been captured, leaving the exact phishing or credential‑harvesting mechanisms unknown.

Given the high‑risk rating, defenders should block resolution of coinbasewebsafe.com at perimeter and endpoint layers, add the IP address 172.67.216.157 to deny lists, and monitor DNS queries for the domain. Continuous re‑assessment is advised to detect any change in HTTP response or the appearance of malicious payloads. Organizations using Coinbase services should alert users to the existence of this counterfeit domain and reinforce corporate policies that only trusted Coinbase URLs are permitted. The combination of multiple vendor detections, a zero‑trust score, and active blocklist inclusion confirms a credible threat, despite the current HTTP 525 response limiting visible payload analysis.