coinbase-verify[.]xo[.]je

This domain, coinbase-verify.xo.je, is assessed as an elevated-risk credential harvesting phishing site specifically targeting Coinbase users. Analysis indicates the infrastructure was designed to deceive victims into submitting login credentials, two-factor authentication codes, or other sensitive account details under the guise of a legitimate verification process. The threat type aligns with brand impersonation, a tactic frequently employed to exploit trust in well-known financial platforms for unauthorized account access or fraudulent transactions. Infrastructure analysis reveals the domain was hosted on IP address 185.27.134.114, geolocated in the United Kingdom under AS34119 (Wildcard UK Limited). The domain currently appears on one security blocklist, while VirusTotal detection metrics report 20 out of 95 security vendors flagging the domain as malicious. No SSL certificate was present, increasing the likelihood of interception or manipulation of transmitted data. The page title, coinbase-verify.xo.je, directly mirrors the domain name, a common indicator of phishing sites attempting to reinforce perceived legitimacy. The registrar for the xo.je second-level domain is Njalla, a provider historically associated with anonymized or abuse-prone registrations. Mitigation against this specific threat involves immediate domain blacklisting at the network perimeter and endpoint levels. Organizations should ensure security controls block access to 185.27.134.114 and the xo.je domain, while also monitoring for internal connections to these indicators. Users who may have interacted with the site should be instructed to reset Coinbase credentials from a verified device, enable multi-factor authentication if not already active, and review account activity for unauthorized transactions. Security teams are advised to correlate logs for connections to the IP address or domain to identify potentially compromised endpoints. Proactive monitoring of newly registered domains under Njalla or similar registrars may help detect emerging threats before they reach end users.