internationaltubular[.]com

The domain internationaltubular.com was a phishing site engaged in brand impersonation targeting Coinbase users. It posed as the legitimate cryptocurrency exchange to deceive victims into disclosing login credentials or sensitive information, classified as a cryptocurrency scam. The site has since been taken offline, but it previously operated as an active phishing threat under the guise of the Coinbase brand.

Technical analysis of internationaltubular.com revealed limited detection, with only 1 of 95 VirusTotal security vendors flagging the domain. It was registered through Tucows Domains Inc. on November 4, 2008, and resolved to the IP address 172.105.106.222, hosted on Akamai Connected Cloud (AS63949) in Canada. The domain appeared on a single security blocklist, PhishDestroy, and used an SSL certificate issued by Let's Encrypt (E7). The observed page title was 'Coinbase,' and the site employed technologies such as Netlify and HSTS. MX records pointed to Google's mail servers, and nameservers were mns01.domaincontrol.com and mns02.domaincontrol.com.

Individuals who interacted with internationaltubular.com should immediately change their Coinbase passwords and enable two-factor authentication (2FA) if they entered credentials. Monitor accounts for unauthorized transactions or suspicious activity. Victims are advised to report the phishing domain to Coinbase's security team and submit abuse reports to the registrar (Tucows Domains Inc.) and hosting provider (Akamai Connected Cloud). Additionally, the domain can be reported to Google Safe Browsing and other threat-intelligence platforms to prevent further exploitation.