homecoinbase[.]wixstudio[.]com

PhishDestroy identifies homecoinbase.wixstudio.com as an active brand impersonation domain targeting Coinbase users. This site leverages Coinbase’s branding to deceive visitors into disclosing sensitive account credentials or financial details. The domain uses a Let’s Encrypt SSL certificate to appear legitimate, but its infrastructure and behavior are consistent with credential harvesting or malware distribution tactics. Security solutions such as MetaMask and SEAL have already blocked access to this domain, indicating a recognized threat. Users interacting with this site risk direct exposure to phishing attacks designed to compromise cryptocurrency accounts. This domain was flagged with a unique threat identifier (seed: fcf539) and shows 0 detections on VirusTotal as of the latest scan, despite being hosted on IP 34.144.206.118. The domain resolves to a Google Cloud IP address and is registered under the Wix.com platform, which has been misused to host malicious content. It has been observed on two separate security blocklists, confirming its malicious intent. The use of a Wix subdomain (wixstudio.com) further attempts to mask the true nature of the site, exploiting a legitimate service to cloak nefarious activity. These indicators collectively point to a sophisticated impersonation campaign aimed at victims of cryptocurrency platforms. If you have visited homecoinbase.wixstudio.com, immediately cease interaction and do not enter any credentials or financial information. Disconnect from the network and run a full antivirus scan on your device. Report the domain to Coinbase via their official phishing reporting channel and consider revoking any session tokens or passwords entered on the site. Monitor your Coinbase account and linked financial services for unauthorized transactions. If possible, change passwords using a different device and enable multi-factor authentication (MFA) on all critical accounts. This domain remains active and should be treated as a high-risk threat until confirmed otherwise by security authorities.