coinbaseaai[.]com

This domain, www.coinbaseaai.com, is flagged as a brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site mimics legitimate Coinbase branding to deceive users into disclosing credentials or financial information. The page title, TagomiX, does not align with Coinbase’s official services, suggesting the use of a generic or repurposed phishing kit designed for credential harvesting or fraudulent transactions.

Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate financial services. It resolves to the IP address 104.21.13.196, hosted on AS13335 (Cloudflare, Inc.), a network frequently leveraged to obscure malicious infrastructure. The SSL certificate, issued by Google Trust Services (WE1), is valid but does not mitigate the domain’s fraudulent intent. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. No detections were recorded in Google Safe Browsing at the time of analysis.

The domain is currently offline, likely due to takedown actions or voluntary suspension by the registrar. However, residual risk persists as threat actors may re-establish the domain or migrate to similar infrastructure. Organizations and users are advised to block the domain and its resolving IP at the network level, monitor for related phishing campaigns, and verify all communications purportedly from Coinbase through official channels. Continuous vigilance is recommended, as impersonation threats often re-emerge under altered domains or hosting configurations.