coinbase[.]deel[.]team

Analysis of the domain coinbase.deel.team indicates high-risk phishing infrastructure targeting Coinbase users, active as of July 25, 2026. The domain was registered on February 21, 2026, through Gandi SAS and currently resolves to 104.18.16.187, hosted on Cloudflare's network (AS13335). Despite the domain name incorporating 'coinbase', the page title reads 'Deel - Your forever people platform', suggesting either misdirection or an attempt to obfuscate the true nature of the site. The domain is flagged by one security vendor on VirusTotal and appears on three blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a crypto scam.

Infrastructure analysis reveals the use of Cloudflare for hosting and security, alongside technologies such as Stripe, Amazon Web Services, Google Tag Manager, and Calendly, which may be employed to lend legitimacy or facilitate fraudulent transactions. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing domains frequently use valid certificates. The HTTP status returns 200, confirming the site is accessible, and the domain remains active at the time of this report. Gridinsoft assigns a trust score of 0/100, further indicating malicious intent.

Defenders should treat this domain as part of a broader crypto scam campaign. Blocking the domain and its associated IP (104.18.16.187) at the network level is recommended, along with monitoring for related infrastructure using the same nameservers (ns-20.awsdns-02.com, ns-609.awsdns-12.net, ns-1488.awsdns-58.org, and others). While the exact content of the site has not been analyzed, the combination of brand impersonation, blocklist presence, and detected technologies aligns with known crypto scam tactics. Further investigation into the domain's traffic and associated wallet addresses is advised to disrupt potential financial fraud.