verify[.]coinbase-invest[.]com

This domain is flagged as a brand impersonation targeting Coinbase. The domain was registered through GoDaddy on January 30, 2026, and remains active. It resolves to IP 172.67.177.80 hosted by Cloudflare in the US. The page title is 'Complete Account Verification' and the HTTP status is 200, indicating the site is live and serving content. Gridinsoft trust score is 0/100, and Google Safe Browsing flags the domain for SOCIAL_ENGINEERING. VirusTotal reports 16 of 91 security vendors flagging it as malicious. It appears on three blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. The domain uses Cloudflare nameservers and an SSL certificate from Google Trust Services, which are common for legitimate sites but here support a fraudulent operation. Defenders should treat this domain as an active threat: block all traffic to it, monitor for users who may have visited or submitted credentials, and add the domain to threat intelligence feeds. The exact nature of the scam page content is not yet analyzed, but the combination of impersonation indicators, low trust scores, and social engineering flags strongly suggests credential harvesting or account takeover attempts. No further technical details about the site's behavior or payloads are available at this time.