190243coinbase[.]com

This domain, 190243coinbase.com, is identified as a brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing they are interacting with legitimate Coinbase services, likely for credential theft or unauthorized account access. The page title, "Google," suggests an attempt to evade detection by mimicking a benign service, a common tactic in phishing infrastructure. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on October 29, 2025. It resolves to the IP address 142.250.185.196, which is associated with legitimate services but may have been leveraged to obscure malicious intent. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while Scamadviser and Gridinsoft assign trust scores of 1/100 and 0/100, respectively. The domain appears on one security blocklist and was detected in a single threat intelligence pulse on AlienVault OTX. No Google Safe Browsing (GSB) detections were recorded at the time of analysis. The domain is currently offline, having been taken down following detection. However, residual risk remains due to the potential for re-registration or migration of the threat to alternative domains. Organizations are advised to monitor for similar impersonation patterns, particularly domains using numeric prefixes or brand names in non-standard formats. Network-level blocking of the observed IP (142.250.185.196) and registrar-based domains may mitigate further exposure. End-users should verify domain authenticity before entering credentials, especially for financial or crypto-related services.