coinbaseus[.]cc

coinbaseus.cc entered the PhishDestroy evidence set on Feb 26, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The stored content classification is crypto scam. The assembled evidence scores 95/100 (critical).

Three independent sources are positive: VirusTotal, Google Safe Browsing, and URLQuery. VirusTotal recorded 16 detections among 93 engines: ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safebrowsing, Kaspersky, Lionic, Seclookup, Sophos, VIPRE, Webroot on Feb 25, 2026 at 00:11 UTC. Google Safe Browsing flagged the domain: Social Engineering on Mar 2, 2026 at 20:50 UTC. URLQuery recorded 2 threat-system alerts on Oct 28, 2025 at 11:47 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLScan completed without a malicious verdict. PhishStats returned no feed match on Mar 2, 2026 at 08:05 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:13 UTC; content was unavailable. Registration records for the domain list Gname.com Pte. Ltd. as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 18.162.150.57 on AS16509 (Amazon.com, Inc.). The associated network metadata labels the endpoint as AWS EC2 (ap-east-1) in Hong Kong, HK. DOM analysis completed on Jul 29, 2026 at 04:13 UTC; stored DOM score 90/100. The evidence archive retains 2 visual captures from PhishDestroy and URLQuery. IoC extraction completed on Aug 2, 2026 at 04:03 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators.

No page title was retained; the visual captures, not a title string, preserve the landing-page appearance. Taken together, the page content and independent findings support classifying this hostname as Coinbase-themed crypto scam.