coinbasepulse[.]live

Analysis of the domain coinbasepulse.live indicates active brand impersonation targeting Coinbase, a cryptocurrency exchange platform. Registered under ASN 396982 (Google LLC) and resolving to IP 34.111.179.208 (US), the domain presents a page titled 'Coinbase Pulse - Social Payments on Base,' directly referencing Coinbase's branding and services. The site is flagged by Google Safe Browsing for social engineering, and 11 of 95 security vendors on VirusTotal have detected malicious activity associated with this domain. It is currently blocked by PhishDestroy and appears on one security blocklist. Infrastructure analysis reveals the use of Let's Encrypt SSL certificate (E7), Node.js, Google Cloud services (including Cloud Trace and CDN), Express framework, HSTS, and HTTP/3. Nameservers are hosted under name.com (ns1cny.name.com, ns2ckr.name.com, ns3jkl.name.com, ns4hny.name.com). The domain remains active, returning an HTTP 200 status, and is classified as a crypto scam. Defenders should treat this domain as high-risk due to confirmed brand impersonation, social engineering flags, and vendor detections. Blocking the domain and associated IP (34.111.179.208) is recommended. Further investigation into the site's content and payload delivery mechanisms is advised, though no specific phishing kit or additional technical artifacts have been confirmed at this time.