519782coinbase[.]com

PhishDestroy identifies 519782coinbase.com as an active Coinbase brand impersonation phishing domain posing an elevated risk to users. The site mimics Coinbase’s login interface to harvest credentials, with a page title of 'Sign in' to enhance deception. This domain was flagged by security vendors for malicious activity and requires immediate caution from internet users. This domain was flagged by 5 of 95 VirusTotal security vendors, indicating partial but concerning detection. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP address 172.67.183.49, and was created on March 29, 2026. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate, despite its malicious intent. As of the latest analysis, PhishDestroy has recorded this domain on 3 active blocklists, with low trust scores across multiple threat intelligence platforms. The domain remains active and should be treated as a high-risk threat to cryptocurrency users. Users are strongly advised to avoid interacting with this domain or entering any credentials. If accessed inadvertently, users should immediately change their Coinbase account passwords and enable two-factor authentication. Organizations and individuals are encouraged to block this domain at the network level and report it to relevant cybersecurity authorities to prevent further exploitation. Continuous monitoring of this domain is recommended due to its active status and evolving tactics.