pages-chrome-coinbase-ext[.]codedesign[.]app

This domain, pages-chrome-coinbase-ext.codedesign.app, operates as a credential harvesting site targeting users of the cryptocurrency exchange Coinbase. The site mimics legitimate Coinbase login pages to deceive visitors into entering their account credentials, which are then captured by threat actors for unauthorized access or financial theft. The infrastructure is designed to appear authentic, leveraging technologies such as React for frontend development and Nginx for web server functionality, which are commonly used in legitimate applications but repurposed here for malicious intent. Analysis indicates the domain was registered on February 01, 2021, through Porkbun LLC, a registrar often exploited due to its accessibility and low barriers to entry. The site resolves to the IP address 35.222.249.229 and holds a Let's Encrypt SSL certificate, which provides a false sense of security to unsuspecting users. Security vendors on VirusTotal flagged this domain, with 6 out of 95 engines detecting it as malicious. Additionally, it appears on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft, further confirming its malicious nature. If you visited pages-chrome-coinbase-ext.codedesign.app or entered any credentials, immediately revoke access to any active sessions on your Coinbase account. Change your password using a secure device and enable multi-factor authentication if not already active. Monitor your account for unauthorized transactions or changes, and report any suspicious activity to Coinbase support. Avoid interacting with any links or communications associated with this domain, as they may lead to further compromise. Consider scanning your device for malware to ensure no additional threats were introduced during the visit.