coinbaseproaloegin[.]webador[.]com

This domain is flagged as a high-risk brand impersonation phishing site specifically targeting Coinbase, a cryptocurrency exchange platform. The site mimics the Coinbase Pro login interface, as evidenced by the page title 'Coinbase Pro Login - Ţrading & Managing Đigital Assets,' which includes subtle character substitutions to evade detection and deceive users into entering credentials. Analysis indicates this is a deliberate attempt to harvest sensitive account information through fraudulent means, posing significant financial and operational risks to affected individuals and organizations. Infrastructure analysis reveals the domain coinbaseproaloegin.webador.com resolves to the IP address 34.90.225.198, hosted on infrastructure belonging to AS396982 (Google LLC) in the Netherlands. The domain was registered on February 21, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. Security vendor detections on VirusTotal indicate 17 out of 95 engines flagged the domain as malicious. The domain appears on three distinct security blocklists, and it is actively blocked by multiple threat intelligence feeds. The SSL certificate is issued by Let's Encrypt (R12), a common tactic used to lend an appearance of legitimacy to phishing sites. The domain has since been taken offline, though historical data remains critical for forensic analysis. Mitigation against brand impersonation phishing requires a multi-layered approach. Organizations should implement domain monitoring to detect newly registered domains containing their brand names or variations, particularly those using homoglyphs or misspellings. Endpoint protection systems should be configured to block known malicious IPs and domains, including those flagged by reputable threat intelligence sources. User education remains essential, focusing on recognizing subtle indicators of phishing, such as irregular characters in URLs or page titles, and verifying SSL certificates through trusted sources. In cases where credentials may have been compromised, immediate password resets and multi-factor authentication enforcement are recommended to prevent unauthorized access.