19349912-coinbase[.]com

The domain 19349912-coinbase.com was registered on October 15, 2025 through Dominet (HK) Limited and is currently offline. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain does not present an SSL certificate, leaving the connection unencrypted. Google Safe Browsing has flagged the site for social engineering, and the listed scam type is a crypto scam targeting Coinbase users.

The page title returned by the server is "Coinbase," matching the declared brand target. Reputation services rate the domain poorly, with Scamadviser assigning a trust score of 1 out of 100. VirusTotal analysis shows that 16 of 95 security vendors marked the domain as malicious. The domain appears on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL.

Nameservers are configured as colin.ns.cloudflare.com, meg.ns.cloudflare.com, pns61.cloudns.net, and pns62.cloudns.co. While the infrastructure details confirm a Cloudflare front‑end and a lack of TLS, the exact content served before takedown has not been examined, leaving the specific phishing page elements unknown. Defenders should continue to block the domain at network gateways, update URL filtering lists with the observed IP and nameserver data, and monitor for any re‑registration attempts that reuse the same registrar or similar naming patterns. Additional scrutiny of traffic to 188.114.97.3 is advised to detect possible residual activity, and security teams should consider adding the domain to threat intelligence feeds to improve early detection of related campaigns.