learn-coinbasecom-sign[.]tem3[.]io

The domain learn-coinbasecom-sign.tem3.io has been identified as a high-risk brand impersonation threat. Analysis confirms it mimics Coinbase, a cryptocurrency exchange platform, with the intent to deceive users into disclosing credentials or sensitive information. The domain is currently offline, but prior activity aligns with phishing campaigns designed to exploit trust in the targeted brand.

Infrastructure analysis reveals the domain was registered on August 2, 2024, through GoDaddy.com, LLC and resolves to the IP address 188.114.97.3. It is flagged by 16 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. Google Safe Browsing categorizes it under SOCIAL_ENGINEERING, and it appears on one security blocklist. Detected technologies include Node.js, React, Next.js, Express, and Cloudflare, suggesting a modern, obfuscated phishing framework. The SSL certificate is issued by Google Trust Services, a common tactic to appear legitimate.

As of the latest assessment, the domain has been taken offline, likely due to mitigation efforts. However, organizations and users are advised to block the domain and associated IP (188.114.97.3) at the perimeter. Monitor for similar patterns, such as newly registered domains impersonating financial services, and enforce multi-factor authentication for all sensitive accounts. Incident response teams should review logs for prior connections to this domain or IP to identify potential compromise.