18397coinbase[.]com

The domain 18397coinbase.com was registered on March 06, 2026 through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.131.231, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The site employed a Node.js stack with Express, Socket.io, HSTS, Cloudflare Browser Insights and HTTP/3, but no SSL certificate was presented. The observed page title reads “Sign in - Cߋinbаse,” indicating an attempt to impersonate the Coinbase brand, and the threat is classified as a crypto‑related scam. VirusTotal analysis shows that one of ninety‑four security vendors flagged the domain, and the URL appears on three independent blocklists.

It has also been explicitly blocked by PhishDestroy, MetaMask and SEAL. The domain’s nameservers are aria.ns.cloudflare.com and braden.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. At the time of reporting the site has been taken offline, but the infrastructure components remain active and could be reused for future impersonation campaigns. Defenders should continue to monitor the associated IP and the Cloudflare nameservers for any reactivation.

Adding 172.67.131.231 to network deny lists and ensuring that corporate web filters reference the three blocklists that already contain the domain can prevent accidental access. Because the registrar information is publicly available, threat‑intel teams should consider requesting domain takedown from NiceNIC International Group Co., Limited if the brand holder files a complaint. Monitoring newly registered domains that combine numeric prefixes with the “coinbase.com” suffix may help to catch similar impersonation attempts early. Organizations should also educate users about the absence of a valid TLS certificate and the malformed page title, reinforcing the policy to verify the HTTPS padlock and official Coinbase URLs before entering credentials.