ww25[.]secure-portal-coinbase[.]com

This domain, ww25.secure-portal-coinbase.com, is a confirmed phishing site designed to steal Coinbase user credentials and financial information. The site mimics the legitimate Coinbase platform, presenting a fake login portal to trick victims into entering their usernames, passwords, and two-factor authentication codes. Analysis indicates the site was created specifically for credential harvesting, a common tactic in cryptocurrency theft operations. The domain’s structure, including the subdomain 'ww25' and the deceptive name 'secure-portal-coinbase,' is engineered to appear legitimate to unsuspecting users, particularly those who may not scrutinize URLs closely. Infrastructure analysis reveals the domain was registered on November 24, 2024, through OwnRegistrar, Inc., a registrar frequently associated with malicious domains. The site resolves to IP address 199.59.243.228, hosted on Amazon Web Services (AS16509), and lacks an SSL certificate, a red flag for phishing activity. At the time of detection, 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The page title, 'secure-portal-coinbase.com,' further confirms its intent to impersonate Coinbase’s official infrastructure. The domain’s rapid takedown suggests it was part of a short-lived campaign, a common characteristic of phishing operations targeting high-value brands. Users who visited ww25.secure-portal-coinbase.com should assume their credentials were compromised. Immediate action is required: reset Coinbase passwords using a secure device and enable multi-factor authentication if not already active. Monitor Coinbase accounts for unauthorized transactions and review linked financial instruments for suspicious activity. If login credentials were reused across other platforms, reset those passwords as well, prioritizing email accounts and financial services. Report the incident to Coinbase’s security team and consider filing a complaint with relevant cybercrime authorities. Avoid interacting with any communications claiming to be from Coinbase that reference this domain, as they may be follow-up phishing attempts.