repair-coinbase[.]com

Analysis of the domain repair-coinbase.com indicates active brand impersonation targeting Coinbase, classified as a high-risk crypto scam. The domain was registered on November 3, 2024, through Web Commerce Communications Limited and currently resolves to IP 145.223.100.150, hosted on AS47583 (Hostinger International Limited) in Germany. Infrastructure analysis reveals Cloudflare and Cloudflare Browser Insights as detected technologies, alongside HTTP/3 support. The domain's nameservers are ns1.dns-parking.com and ns2.dns-parking.com, a configuration often associated with low-cost or disposable hosting setups. The page title, 'Voyage Lumière – Explorez le Monde sur Mesure,' does not align with Coinbase's branding or typical phishing page titles, suggesting either a misconfiguration, a placeholder, or an attempt to evade keyword-based detection.

The domain returns an HTTP 403 status, indicating access is restricted or the server is actively blocking requests, which may be a tactic to hinder automated scanning or analysis. A Let's Encrypt SSL certificate (serial E8) is present, providing HTTPS encryption but offering no assurance of legitimacy. Detection data shows the domain is flagged by 15 of 95 security vendors on VirusTotal and appears on one security blocklist. PhishDestroy has blocked the domain, and Gridinsoft assigns it a trust score of 0/100. The scam type is explicitly classified as a crypto scam, consistent with the impersonation of Coinbase, a cryptocurrency exchange platform.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS, proxy, or firewall level. The combination of brand impersonation, low trust scores, and detection by multiple vendors warrants immediate action. Further investigation into the hosting IP (145.223.100.150) and associated domains may reveal additional threats.