coinbase-authorization[.]coinny-portal[.]com

This domain, coinbase-authorization.coinny-portal.com, is a confirmed credential harvesting site designed to impersonate Coinbase, a cryptocurrency exchange platform. The site targets users by mimicking legitimate authentication portals, tricking victims into entering sensitive login credentials, two-factor authentication codes, or recovery phrases. Infrastructure analysis reveals the domain was engineered to exploit trust in the Coinbase brand, likely distributing stolen credentials to threat actors for unauthorized account access or financial theft. The absence of an SSL certificate further increases the risk of data interception during transmission, exposing users to man-in-the-middle attacks. Analysis indicates the domain was registered on December 06, 2025, through Web Commerce Communications Limited, a registrar frequently associated with malicious infrastructure. The domain resolves to IP address 104.21.93.109, hosted on Cloudflare’s network (AS13335), a common tactic to obscure the true origin of phishing operations. Security vendors have flagged the domain on VirusTotal, with 14 out of 95 engines detecting it as malicious. Additionally, the domain appears on three independent security blocklists, and Google Safe Browsing categorizes it as a phishing site. The combination of brand impersonation, lack of encryption, and widespread detection underscores its high-risk classification. Users who visited coinbase-authorization.coinny-portal.com should immediately revoke any entered credentials by resetting passwords and disabling compromised two-factor authentication methods. Accounts linked to the domain should be audited for unauthorized transactions or configuration changes. If financial data or recovery phrases were submitted, affected users must transfer assets to new, secure wallets and monitor for suspicious activity. Browser caches and saved passwords should be cleared to prevent accidental revisits. Network-level blocking of the domain and its resolving IP (104.21.93.109) is recommended to mitigate further exposure.