coimbaselogin[.]netlify[.]app

Analysis indicates that coimbaselogin.netlify.app operates as an active brand impersonation site targeting Coinbase users. The domain hosts a fabricated sign-in interface that replicates the legitimate Coinbase authentication flow to harvest credentials from visitors. Infrastructure analysis reveals consistent use of Netlify hosting combined with a DigiCert SSL certificate to establish a facade of legitimacy.

Technical indicators confirm the threat level through multiple data points. VirusTotal reports 1/95 security vendors flagging the domain. The domain resolves to IP address 63.176.8.218 and triggers explicit SOCIAL_ENGINEERING warnings in Google Safe Browsing. Registration occurs through Netlify with current active status and an exact page title match of Sign in to Coinbase.

Users who accessed this domain should immediately change Coinbase account passwords from a verified device, enable all available multi-factor authentication mechanisms, and review recent account activity for unauthorized transactions. Network logs should be examined for any data transmission to 63.176.8.218. Affected parties are advised to report the domain to Coinbase security teams and monitor financial statements for signs of compromise. Continued avoidance of the domain remains essential given its ongoing operational status.