wallet-backup-base[.]com

This domain, wallet-backup-base.com, is flagged as a crypto scam impersonating Coinbase, a cryptocurrency exchange platform. Registered on September 29, 2025, through Onlinenic Inc, the domain resolved to IP 38.132.122.243 (AS9009 M247 Europe SRL, US) and was hosted on nameservers ns45.glowhost.net and ns46.glowhost.net. The page title, 'Coinbase: The Most Trusted Place To Buy, Sell & Use Crypto,' directly mimics Coinbase branding, indicating an intent to deceive users into believing the site is legitimate. No SSL certificate was present, increasing the risk of unencrypted data transmission.

The domain appeared on one security blocklist (PhishDestroy) and was taken offline by the report date of July 22, 2026. While 95 vendors scanned the domain on VirusTotal, none currently flag it as malicious, though this does not confirm safety. Defenders should treat this domain as high-risk due to its association with brand impersonation and crypto scam activity. Infrastructure analysis reveals a pattern consistent with phishing operations, including the use of a hosting provider commonly linked to malicious domains.

Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as these may indicate further campaign activity. Blocking the domain and its associated IP at the network level is recommended to prevent potential exposure. Further investigation into the hosting provider and registrar may uncover additional malicious domains tied to this threat actor.