teamcoinbasesupport[.]online

This domain, teamcoinbasesupport.online, is an active phishing infrastructure designed to impersonate Coinbase, a major cryptocurrency exchange platform. The site targets users by mimicking legitimate support channels, likely deploying credential harvesting tactics to steal login credentials, two-factor authentication codes, or other sensitive account information. Analysis indicates the domain is structured to deceive victims into believing they are interacting with official Coinbase support, increasing the likelihood of successful compromise given the brand's widespread use in digital asset management. Infrastructure analysis reveals the domain was registered on December 20, 2025, through Dynadot Inc, a registrar frequently observed in phishing campaigns. As of the latest assessment, the domain is flagged by 4 out of 95 security vendors on VirusTotal, indicating moderate detection but persistent risk. It resolves to the IP address 198.251.83.49 and is currently listed on three security blocklists, including high-confidence threat intelligence feeds. The SSL certificate, issued by Let's Encrypt, provides encryption but does not validate legitimacy, as phishing sites commonly exploit free certificate authorities to appear secure. Users who have visited teamcoinbasesupport.online or entered credentials on the site should assume compromise and take immediate action. Reset all passwords associated with Coinbase accounts, enable multi-factor authentication if not already active, and review account activity for unauthorized transactions. Monitor linked financial accounts and cryptocurrency wallets for signs of fraudulent activity. If sensitive information was disclosed, consider reporting the incident to relevant financial authorities and cybersecurity response teams for further mitigation. The domain remains active, and continued vigilance is advised.