178490-coinbase[.]com

This domain, 178490-coinbase.com, represents a high-risk brand impersonation campaign specifically targeting Coinbase users. Analysis indicates the site was designed to closely mimic the legitimate Coinbase platform, likely to harvest cryptocurrency wallet credentials or deploy crypto-draining malware. The inclusion of the Coinbase brand name in the domain, combined with the absence of SSL encryption, suggests an intent to deceive users into entering sensitive login or transaction details on an unsecured connection, enabling unauthorized access to digital assets. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on December 20, 2025, through NameSilo, LLC, and resolves to the IP address 194.26.192.105, hosted under AS210558 (1337 Services GmbH) in the Netherlands. Security vendors on VirusTotal flagged the domain as malicious in 18 out of 95 detections, while it appears on three distinct security blocklists. The page title, identical to the domain name, further confirms its lack of legitimacy, as legitimate services typically use descriptive, brand-aligned titles rather than raw domain strings. Users who visited 178490-coinbase.com should immediately revoke any active sessions associated with cryptocurrency wallets or exchanges. If credentials were entered, they must be changed from a secure device, and multi-factor authentication (MFA) should be enabled where available. Wallet addresses or transaction details shared on the site should be considered compromised, and users are advised to monitor accounts for unauthorized activity. Additionally, affected parties should report the incident to relevant financial and cybersecurity authorities to aid in tracking and mitigating the campaign.