coinbasechatadmin[.]cc[.]steadelite[.]cc

The domain coinbasechatadmin.cc.steadelite.cc was registered on December 23, 2024 through NameSilo, LLC and is currently listed as taken offline. DNS resolution points to IP address 198.12.93.82, which belongs to AS36352 HostPapa and is geolocated to the United States. The domain uses the authoritative name servers ns1.megatronserver.com and ns2.megatronserver.com, indicating that the hosting infrastructure is shared with other megatronserver.com services. No TLS certificate is presented, meaning the site is reachable only via HTTP, which is typical for low‑cost impersonation campaigns.

The page title returned from the HTTP response is "Send Email," suggesting an intent to harvest email addresses, but the actual page content has not been examined. The threat is classified as a crypto‑related brand impersonation targeting Coinbase, consistent with the "Crypto Scam" label supplied. Detection signals include inclusion on a single security blocklist and a specific block by PhishDestroy. Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 out of 100, and Scamadviser rates the domain at 1 out of 100.

VirusTotal analysis shows that eight of ninety‑five scanning engines flagged the domain, reinforcing the malicious assessment. While the domain is offline, defenders should continue to monitor the associated IP address and the megatronserver.com name servers for reuse in future campaigns. Network‑level blocks on 198.12.93.82, DNS sink‑hole entries for the domain, and heuristic filters for HTTP sites lacking SSL that reference Coinbase should be deployed. Additional scrutiny of any new subdomains created under the same registrar or name server pair is recommended, as the infrastructure pattern may reappear in subsequent impersonation attempts.