893428coinbase[.]com

This domain, 893428coinbase.com, presents an elevated risk as a brand impersonation threat specifically targeting Coinbase users. The site was designed to deceive visitors into believing they are on the legitimate Coinbase platform, as evidenced by its page title, 'Coinbase - Buy and Sell Bitcoin, Ethereum, and more with trust.' This type of phishing aims to steal login credentials, personal information, or cryptocurrency funds from unsuspecting users.

Technical indicators paint a clear picture of a malicious operation. The domain was created on March 13, 2026, and was registered through NiceNIC International Group Co., Limited, known for lax oversight. It resolves to IP address 104.21.60.185, which is associated with Cloudflare. VirusTotal analysis shows that 3 out of 95 security vendors flagged this domain as malicious, indicating low confidence but confirmed maliciousness. The domain utilizes a Let's Encrypt SSL certificate with fingerprint E8, which is common for phishing sites seeking to appear legitimate. It appears on 1 security blocklist, further corroborating its threat status. Notably, the site is currently offline, suggesting successful takedown efforts.

Users who may have visited this domain should take immediate action to protect their accounts. If any credentials were entered, they must change their Coinbase password and enable two-factor authentication immediately. Additionally, users should monitor their Coinbase account for unauthorized transactions and report any suspicious activity to Coinbase support. It is also advisable to run a security scan on the device used to access the phishing site to check for any malware. Avoiding similar domains that mimic legitimate services by carefully verifying URLs before entering sensitive information is crucial for ongoing safety.