coinbase-blog[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Coinbase users. Analysis indicates the site mimics the legitimate Coinbase Learn portal, likely designed to harvest login credentials or cryptocurrency wallet details through deceptive interfaces. The threat type aligns with credential phishing and wallet-drain schemes, common in cryptocurrency-related fraud. Infrastructure analysis reveals the domain was registered on December 22, 2025, through Dynadot LLC. It resolves to IP 142.250.185.147 (AS15169, Google LLC) and uses an SSL certificate issued by Google Trust Services (WR3). VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing classifies it as a phishing site. The page title, 'Coinbase Learn,' further confirms the intent to deceive users seeking educational content. Mitigation requires immediate blocking of the domain and its associated IP across network security controls. Users should be alerted to verify URLs before entering credentials, particularly for cryptocurrency platforms. Security teams should monitor for similar impersonation patterns, such as newly registered domains with slight variations of legitimate brand names. Enforcing multi-factor authentication (MFA) and wallet transaction approvals can reduce the impact of credential theft. If exposure is suspected, affected accounts should be locked, credentials reset, and wallet addresses reviewed for unauthorized changes.