coinbasewallet-s[.]us[.]a-atomicwallet[.]com

This domain, coinbasewallet-s.us.a-atomicwallet.com, is flagged as a brand impersonation threat targeting Coinbase. The domain was created on February 21, 2026, and was taken offline as of July 24, 2026. The page title for the domain is 'Coinbase Wallet - Download & Login Your Coinbase Account', which suggests an attempt to deceive users into believing they are interacting with a legitimate Coinbase service. Infrastructure analysis reveals that the domain resolves to the IP address 142.11.248.171, hosted by Hostwinds LLC. in the United States (AS54290).

The Gridinsoft trust score for this domain is 0/100, indicating a very low level of trust. The domain appears on one security blocklist and has been blocked by PhishDestroy. Analysis indicates that 11 of 95 security vendors on VirusTotal flag this domain as malicious, though it is currently offline. The SSL certificate is identified as R13.

The exact content of the web page is not yet analyzed, but the page title and domain name strongly suggest that this is a crypto scam designed to impersonate Coinbase services. Defenders should ensure that this domain is blocked in their security configurations and educate users to verify the authenticity of Coinbase links before clicking or entering credentials. Even though the domain is currently offline, it may reappear, and monitoring for its resurgence is recommended.