coinbase[.]ir

Analysis indicates that the domain coinbase.ir currently resolves to the IPv4 address 185.55.227.198. The address is part of the Iranian autonomous system AS201999, operated by Fanavari Serverpars Argham Gostar Company Ltd. Domain delegation points to four name servers: irns147.parsdn.com, irns148.parsdn.com, irns27.serverpars.com, and irns28.serverpars.co. No TLS certificate is presented, and an HTTP request returns a 503 Service Unavailable response. The sole page title returned by the server reads “This Domain Is For Sale,” which provides no functional content for credential collection.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal scans show that four of ninety‑five antivirus or URL‑reputation engines have flagged the domain, giving a detection rate of roughly 4%. The intelligence tags the activity as a crypto‑related scam and identifies the target brand as Coinbase, indicating a brand‑impersonation campaign aimed at deceiving users seeking cryptocurrency services. The risk level is assigned as elevated, reflecting the potential financial impact of a successful impersonation.

At the time of this report (July 24, 2026) the domain is marked as offline, and the absence of an SSL certificate limits the ability to assess any encrypted payload. Because the site presently returns only a sale notice, the exact phishing construct cannot be confirmed, and further monitoring is required.

Defenders should add coinbase.ir to deny‑lists in web filtering solutions, monitor DNS queries for the listed name servers, and consider blocking traffic to the associated IP address. Incident response teams should treat any traffic originating from this domain as potentially hostile, especially if it appears in user‑initiated requests for cryptocurrency transactions. Security teams should also verify that internal assets have not resolved to this IP; any host found doing so should be quarantined and investigated.