01281coinbase[.]com

This domain is flagged as a credential phishing site impersonating Coinbase, a major cryptocurrency exchange platform. Attackers use such domains to deceive users into entering login credentials, recovery phrases, or two-factor authentication codes, which are then harvested for unauthorized account access or financial theft. The site mimics legitimate security checks, displaying a page titled 'Checking the security of your connection' to appear trustworthy while capturing sensitive user input. Analysis indicates the domain was registered on November 14, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious infrastructure. It resolves to the IP address 172.67.133.3 and is currently offline. VirusTotal reports that 6 out of 95 security vendors detect this domain as malicious, and it appears on one security blocklist. The Gridinsoft trust score of 0/100 further confirms its high-risk classification. If you visited 01281coinbase.com, immediately revoke any active sessions on your Coinbase account and enable multi-factor authentication if not already active. Change your password using a separate, trusted device and monitor your account for unauthorized transactions or configuration changes. Report the incident to Coinbase’s security team and consider scanning your device for malware, as phishing sites may deploy additional payloads. Avoid reusing credentials across platforms, and verify domain authenticity before entering sensitive information.