auth-coin-pro-login[.]tem3[.]io

This domain is flagged as an elevated-risk brand impersonation threat targeting Coinbase users through a fraudulent login portal. Analysis indicates the site mimics the official Coinbase Pro interface, presenting a page titled 'Coinbase Pro Login: | ( Official Site®) | Sing In Your Account®' to deceive victims into submitting credentials. The threat type is classified as credential harvesting with brand spoofing, a tactic commonly employed to compromise financial and cryptocurrency accounts. Infrastructure analysis reveals the domain auth-coin-pro-login.tem3.io was registered on May 6, 2026, an anomalous future date suggesting potential registrar manipulation or domain generation algorithm abuse. It resolves to IP address 188.114.97.3, geolocated in Canada and associated with Cloudflare, Inc. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited by threat actors to lend false credibility. Detection metrics show 17 of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist and is actively blocked by a specialized anti-phishing system. The domain is currently offline, though its infrastructure remains a latent risk. Mitigation requires immediate action from network defenders and end users. Organizations should update web filtering rules to block the domain and its resolving IP (188.114.97.3) at perimeter security controls. Security teams are advised to monitor for credential reuse attempts, particularly targeting Coinbase or cryptocurrency-related accounts. Users who interacted with the domain should reset passwords via official channels and enable multi-factor authentication. Registrars and hosting providers should investigate the anomalous 2026 creation date for potential abuse patterns. Proactive threat hunting for similar domains using the 'tem3.io' subdomain pattern is recommended to identify related campaigns.