usa[.]coinbasesc[.]vip

Analysis of the domain usa.coinbasesc.vip indicates a confirmed crypto scam operation targeting Coinbase users, currently offline as of July 24, 2026. The domain was registered on November 20, 2025, through 22net, Inc., and resolves to the IP address 45.207.200.143, hosted on AS8796 (FASTNET DATA INC) in the United States. Infrastructure review reveals the absence of an SSL certificate, a trust score of 0/100 from Gridinsoft, and nameservers ns1.22.cn and ns2.22.cn, which may suggest a pattern associated with previous phishing campaigns. The page title 'coinbase SC' and the domain structure strongly align with brand impersonation tactics, though no specific phishing kit or exact content has been confirmed.

Fifteen of 95 security vendors on VirusTotal flagged the domain as malicious, reinforcing its classification as a crypto scam. The domain appears on one security blocklist and is blocked by PhishDestroy. While the site is currently offline, historical resolution data and detection metrics provide sufficient evidence to classify this as an elevated-risk threat.

Defenders should treat this domain as compromised and maintain blocklist entries for both the domain and its associated IP. Monitoring for re-registration or DNS changes is recommended, as threat actors frequently re-deploy infrastructure. No further details about the scam mechanics or victim interactions are available at this time.