coibase-pro-auth-star-en[.]tem3[.]io

This domain, coibase-pro-auth-star-en.tem3.io, poses a high-risk threat as a fraudulent impersonation of Coinbase Pro, a cryptocurrency exchange platform. The site mimics the official Coinbase Pro interface, using the page title 'Home | Official Site - Coinbase Pro®' to deceive users into entering sensitive credentials, such as login details, two-factor authentication codes, or financial information. Such impersonation campaigns are commonly used to facilitate unauthorized account access, cryptocurrency theft, or identity fraud. The domain’s infrastructure and content are designed to exploit trust in the Coinbase brand, increasing the likelihood of successful compromise for unsuspecting visitors. Analysis indicates the domain was registered on August 2, 2024, through GoDaddy.com, LLC, a registrar frequently abused for malicious infrastructure. It resolves to the IP address 188.114.97.3, hosted behind CloudFlare, Inc., a service often leveraged to obscure the true origin of phishing sites. Security vendors have flagged the domain as malicious, with 18 out of 95 engines on VirusTotal detecting it as phishing or fraudulent. Additionally, the domain appears on one security blocklist, and Google Safe Browsing has classified it as a phishing threat. The SSL certificate, issued by Google Trust Services (WE1), further legitimizes the site’s appearance, increasing its potential to deceive users. Users who visited coibase-pro-auth-star-en.tem3.io should immediately assume their credentials or personal information may have been compromised. Affected individuals should change passwords for any accounts accessed or entered on the site, particularly those associated with Coinbase or other cryptocurrency platforms. Enabling multi-factor authentication (MFA) on all sensitive accounts is strongly recommended. Users should also monitor their accounts for unauthorized transactions or suspicious activity and report any anomalies to the legitimate service provider. If financial data was entered, contacting the relevant financial institution to flag potential fraud is advised. Finally, affected users should scan their devices for malware, as phishing sites may distribute additional malicious payloads.