login-coilnbase[.]signin-coilnbase[.]settings-mywallet[.]tiendadamafeliz[.]com[.]mx

This domain, login-coilnbase.signin-coilnbase.settings-mywallet.tiendadamafeliz.com.mx, is identified as a high-risk brand impersonation threat targeting Coinbase users. Analysis indicates the subdomain structure mimics legitimate Coinbase authentication pathways, including terms such as 'login,' 'signin,' and 'settings-mywallet,' designed to deceive users into disclosing wallet credentials or personal information. The page title, 'Deloitte France I Cabinet de conseil et d'audit,' is anomalous and unrelated to the purported Coinbase functionality, suggesting either misconfiguration or deliberate obfuscation of the phishing infrastructure.

Technical indicators reveal multiple red flags: the domain is flagged by 8 out of 95 security vendors on VirusTotal, with Google Safe Browsing classifying it under 'SOCIAL_ENGINEERING.' The domain was registered on March 02, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to the IP address 104.82.110.74 and is currently present on three security blocklists. Detected technologies include Varnish, Bootstrap, Trustpilot, OneTrust, and HSTS, which may be employed to lend an appearance of legitimacy or to evade detection mechanisms.

As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat due to its recent creation date and association with a known high-risk registrar. Users who may have interacted with this domain are advised to revoke any active sessions, reset credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and IP address, while security teams should investigate related infrastructure for further compromise indicators.