attempt-coinbase[.]com

This domain, attempt-coinbase.com, operates as a fraudulent credential harvesting portal targeting users of the cryptocurrency exchange Coinbase. Analysis indicates the site presents a fabricated login interface designed to capture usernames, passwords, and potentially two-factor authentication codes. The infrastructure mimics legitimate Coinbase branding to deceive victims into disclosing sensitive account access details, which could lead to unauthorized fund transfers or account takeovers. The page title 'Google' further suggests an attempt to evade detection by masquerading as a benign service while redirecting users to malicious endpoints. Evidence confirms the domain was registered on October 31, 2025, through NiceNIC International Group Co., Limited. Security telemetry from VirusTotal reveals 12 out of 95 vendors flag the domain as malicious, while it appears on at least one security blocklist. The domain resolves to the IPv6 address 2a00:1450:4001:812::2004, hosted under AS15169 (Google LLC), though no SSL certificate is present. Google Safe Browsing explicitly classifies the domain as phishing, and an independent security feed (PhishDestroy) has blocked access. The absence of encryption and the use of a high-reputation hosting provider’s infrastructure are consistent with tactics used to bypass initial scrutiny. Users who visited attempt-coinbase.com or entered credentials should immediately revoke active sessions on their Coinbase accounts and enable multi-factor authentication if not already active. Monitor account activity for unauthorized transactions and report any suspicious behavior to the platform’s support team. Reset passwords for any accounts where the same credentials were reused, as compromised login details may be tested across other services. Security teams should update blocklists to include this domain and its associated indicators, including the IPv6 address and registrar details, to prevent further exposure.