coin-bay[.]net

This domain, coin-bay.net, presents an elevated-risk brand impersonation threat targeting Coinbase users through a fabricated login portal. The phishing page, titled CoinBay, mimics the legitimate Coinbase interface to harvest credentials and potentially deploy cryptocurrency-draining scripts. Analysis indicates the site was designed to deceive users into entering sensitive account details, which could lead to unauthorized access and financial theft. The presence of HTTP/3 and Cloudflare hosting suggests an attempt to evade detection and enhance operational security for the threat actors. Infrastructure analysis reveals the domain was registered on April 23, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent domains. As of the latest assessment, the domain resolves to the IP address 172.67.134.151 and has been flagged by 1 out of 95 security vendors on VirusTotal. Additionally, the domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and holds a trust score of 0/100, indicating a complete lack of legitimacy. The use of Cloudflare further complicates attribution and takedown efforts. Users who visited coin-bay.net or entered credentials on the site should immediately revoke any active sessions on their Coinbase account and enable multi-factor authentication. It is recommended to scan the device used for access with updated security tools to detect potential malware or unauthorized data exfiltration. Affected individuals should also monitor their financial accounts for unauthorized transactions and report the incident to relevant fraud response teams. The domain has since been taken offline, but users should remain vigilant for similar impersonation attempts targeting cryptocurrency platforms.