login[.]coinbase[.]earth

The domain login.coinbase.earth is a confirmed phishing site engaged in brand impersonation targeting Coinbase users. It presents itself as a legitimate cryptocurrency login portal but is designed to harvest credentials through a credential phishing scam. No cryptocurrency drainer kit was identified. The site is currently taken offline, though its prior activity poses an elevated risk to individuals who may have interacted with it.

Technical indicators confirm the malicious nature of login.coinbase.earth. As of analysis, 3 of 95 VirusTotal security vendors flagged the domain, including ChainPatrol, alphaMountain.ai, and SOCRadar. The domain was created on February 21, 2026, and resolves to the IP address 199.59.243.228, hosted on Amazon.com, Inc. infrastructure (AS16509) in the US. It appears on one security blocklist, PhishDestroy, and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by R12, and the observed page title was 'coinbase.earth'. No registrar information is available.

Individuals who visited login.coinbase.earth should immediately change their Coinbase passwords and enable two-factor authentication if they entered credentials. Monitor accounts for unauthorized transactions or login attempts. Victims are advised to report the phishing domain to Coinbase’s security team and submit the URL to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.