265432103[.]am[.]coinbase[.]cm

The domain 265432103.am.coinbase.cm is a phishing site engaged in brand impersonation targeting Coinbase, a cryptocurrency exchange. It poses an elevated risk by presenting itself as a legitimate Coinbase platform for buying and selling Bitcoin and Ethereum, specifically targeting German-speaking users. The site does not employ a known drainer kit but is designed to harvest login credentials or sensitive financial information. As of the latest verification, 265432103.am.coinbase.cm has been taken offline.

Technical indicators confirm the domain's malicious nature. Only 1 of 95 VirusTotal security vendors flagged 265432103.am.coinbase.cm, while it appears on 1 security blocklist (PhishDestroy). The domain was registered through Netcom.cm Sarl on May 12, 2025, and resolves to the IP address 172.64.152.241, hosted on Cloudflare's infrastructure in the US. No SSL certificate is present, and the observed page title reads 'Coinbase Deutschland – Sicherer Kauf und Verkauf von Bitcoin, Ethereum und mehr'. The domain uses nameservers ns1.adtraks.com and ns2.adtraks.com, and currently returns an HTTP 404 status.

Individuals who interacted with 265432103.am.coinbase.cm should immediately change their Coinbase passwords and enable two-factor authentication (2FA) if they entered credentials. Monitor accounts for unauthorized transactions or suspicious activity. Victims are advised to report the phishing domain to Coinbase's security team and to platforms like Google Safe Browsing or PhishTank. If cryptocurrency transactions were initiated, revoke any token approvals and consider transferring funds to a new wallet to mitigate potential losses.