invoiced[.]world

The domain invoiced.world was registered on May 18, 2026 through Global Domain Group LLC and immediately began serving HTTP 301 redirects. The site resolves to 188.114.97.3, a Cloudflare‑owned address located in Canada, and uses a Let's Encrypt E7 certificate for TLS termination. Its authoritative nameservers are jasmine.ns.cloudflare.com and jacob.ns.cloudflare.com, indicating reliance on Cloudflare’s DNS infrastructure.

The landing page presents the title “Coinbase Commerce – Invoice,” a clear attempt to mimic Coinbase’s invoicing service and lure users into credential or payment data submission. The site’s SSL certificate is valid, which may increase user trust, while the brand impersonation is reinforced by the exact brand name usage in the title. Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting a high likelihood of malicious intent.

Threat intelligence sources corroborate the suspicion: VirusTotal reports one out of ninety‑five security vendors flagging the domain, and AlienVault OTX lists it in a single threat pulse. The domain appears on three public blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple security communities have identified it as hostile. The risk level is rated high, and the status remains active as of the report date.

Defenders should add invoiced.world to web‑filter and DNS‑sinkhole policies, monitor for any outbound connections to the associated IP, and enforce strict validation of any Coinbase‑related communications within their environments. Users should be educated to verify the authenticity of invoice links and to report any unsolicited requests that reference Coinbase services. Continuous re‑evaluation of the domain’s classification is advised, as further activity or additional vendor detections could alter the threat posture.