page-setup-coins[.]zapier[.]app

This domain is flagged for elevated-risk brand impersonation targeting Coinbase users, specifically mimicking the Coinbase Pro login interface. The threat involves credential harvesting, where victims are deceived into entering sensitive account details on a fraudulent page designed to replicate the legitimate Coinbase Pro authentication portal. Analysis of the page title, "Coinbase Pro Login® Secure™," confirms the intent to mislead users into believing the site is an official Coinbase property. Infrastructure analysis reveals the following technical indicators: the domain is registered through Name.com, Inc., and resolves to IP address 64.239.123.193, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain was created on March 04, 2026, though this date may reflect manipulation or an error in registration records. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious domains. Security vendor detections on VirusTotal report 20 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and has been taken offline, though historical or cached versions may still pose risks. The combination of brand impersonation, low detection rates, and cloud-based hosting suggests a targeted campaign with moderate sophistication. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address (64.239.123.193) at the network perimeter. Organizations should monitor for signs of credential theft, such as unusual login attempts or account lockouts, particularly for users who may have interacted with the fraudulent page. End-user education should emphasize verifying domain authenticity before entering credentials, especially for financial platforms. Security teams should review logs for connections to the domain or IP and investigate any compromised accounts. Given the use of a legitimate app platform (Zapier) as a hosting vector, additional scrutiny of subdomains under similar services is recommended to identify potential copycat threats.