coinbase-2[.]tem3[.]io

This domain is flagged for elevated-risk brand impersonation targeting Coinbase users through a fraudulent login portal. Analysis indicates the threat type is credential harvesting, designed to mimic the official Coinbase authentication interface to steal user credentials and potentially facilitate unauthorized access to cryptocurrency accounts. Infrastructure analysis reveals the domain coinbase-2.tem3.io was registered on August 02, 2024, through GoDaddy.com, LLC. It resolves to the IP address 188.114.97.3, hosted by CloudFlare, Inc. in Canada. The domain appears on one security blocklist, and VirusTotal reports 17 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by Google Trust Services under the identifier WE1. The page title observed was "Coinbase.com® Account Login | Sign In | Buy Crypto Currency," reinforcing the impersonation attempt. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address (188.114.97.3) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate details into security monitoring systems to detect related activity. End-users should be educated to verify the legitimacy of login portals by checking the URL, SSL certificate issuer, and domain registration details before entering credentials. Multi-factor authentication (MFA) should be enforced for all cryptocurrency-related accounts to mitigate the impact of credential theft.