base[.]visionew[.]top

base.visionew.top is currently flagged as a brand‑impersonation site targeting Coinbase. The domain was registered on 21 February 2026 and resolves to the IPv4 address 43.255.159.94, which is announced by AS42960 (VH Global Limited) and geolocated to Hong Kong. The site presents the page title “Coinbase”, matching the advertised brand target, and is classified as a crypto‑scam in the intelligence feed. VirusTotal has recorded detections from 15 out of 93 scanning engines, indicating that a notable subset of security products consider the host malicious.

Independent blocklist monitoring shows the domain listed on a single security blocklist and it is actively blocked by the PhishDestroy service. Reputation services assign a trust score of 0 / 100 on both Gridinsoft and Scamadviser, reinforcing the conclusion that the domain is untrusted. The TLS certificate is identified as “R13”, a low‑grade rating that further suggests weak or mis‑issued encryption. The site is presently offline, which limits real‑time verification of its content, but the available artifacts are sufficient to treat the domain as hostile.

Uncertainty remains regarding the exact payload or phishing page structure, as no live HTTP response or content sample has been captured. Defenders should add 43.255.159.94 to network‑level deny lists, enforce DNS‑level blocking for base.visionew.top, and monitor for any future re‑hosting of the domain. Continuous re‑scanning on VirusTotal and periodic checks of blocklist feeds are recommended to capture any changes in detection status. Organizations that use Coinbase services should alert users to the existence of this impersonating domain and reinforce authentication best practices, such as hardware‑based 2FA, to mitigate credential‑theft risk.