736623coinbase[.]com

Analysis of 736623coinbase.com, first observed on November 16 2025, shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain is registered through OwnRegistrar, Inc. and is fronted by Cloudflare services, as indicated by the detected technology and the IPv6 address 2606:4700:3035::6815:4fce, which belongs to AS13335 Cloudflare, Inc. in the United States. TLS termination is provided by a Google Trust Services certificate issued to WE1, confirming the use of a legitimate certificate authority but not the authenticity of the underlying site.

VirusTotal records indicate that 17 of 95 security vendors have flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The site returned HTTP 403, suggesting access is currently denied, and PhishDestroy has already added the domain to its blocklist, where it appears on one additional security blocklist. Nameservers rosemary.ns.cloudflare.com and vasilii.ns.cloudflare.com further corroborate the Cloudflare hosting posture.

The combination of brand impersonation, the crypto‑scam label, and the high detection rate warrants a high risk rating. Defenders should continue to block the domain at network perimeters, update URL filtering policies, and monitor for any resurgence of the domain or related infrastructure. No additional page‑content analysis is available, leaving the exact malicious payload unknown.