coinbase[.]pxxl[.]one

This domain is flagged as a high-risk credential-harvesting phishing site targeting Coinbase users. Analysis indicates the site is designed to mimic Coinbase’s official support portal, as evidenced by the page title "Coinbase Help," with the intent to steal login credentials, authentication tokens, or financial details from unsuspecting victims. Infrastructure analysis reveals the domain resolves to IP address 188.114.97.3 and is registered through Dynadot Inc. The SSL certificate is issued by Let’s Encrypt (serial number E7), a common tactic to lend superficial legitimacy. Detection metrics show 16 out of 95 security vendors on VirusTotal flag the domain as malicious. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further confirming its malicious classification. No legitimate creation date or historical context is available, suggesting recent registration for short-term malicious use. Mitigation steps include immediate blacklisting of the domain and associated IP address (188.114.97.3) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint (E7) into endpoint detection and response (EDR) systems. User awareness training should emphasize verifying domain authenticity, particularly for support or login pages, and reporting suspicious URLs. Organizations should enforce multi-factor authentication (MFA) and monitor for unauthorized access attempts linked to this campaign.