coinbaseceh[.]me

This domain represents a targeted credential harvesting operation designed to impersonate Coinbase, a major digital asset exchange platform. Analysis indicates the site was engineered to capture login credentials, payment details, and personal identification information from users attempting to access cryptocurrency services. The page title, 'Coinbase One-stop global investment with professional forex trading and digital asset services,' directly mimics legitimate Coinbase branding while introducing unrelated financial services to broaden the attack surface and appeal to a wider victim base. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain coinbaseceh.me was registered on November 03, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent domains. Security vendors on VirusTotal flagged the domain at a rate of 18/95, indicating widespread detection across multiple threat intelligence platforms. The domain resolves to IP address 192.252.180.21, hosted by CTG Server Limited in Hong Kong (AS152194), a network segment with a history of hosting phishing infrastructure. Google Safe Browsing has explicitly classified the domain as phishing, and it appears on at least one security blocklist. Notably, the domain lacks an SSL certificate, a critical omission that exposes user-submitted data to interception during transmission. Users who visited coinbaseceh.me should immediately take corrective actions to mitigate potential compromise. First, reset all credentials associated with Coinbase or any financial accounts accessed from the same device or session. Enable multi-factor authentication on all sensitive accounts to prevent unauthorized access. Monitor financial statements and transaction histories for unauthorized activity, particularly focusing on digital asset transfers or forex-related transactions. If personal or payment information was entered, consider placing a fraud alert with credit reporting agencies and reviewing identity protection measures. Devices used to access the domain should undergo a full security scan to detect potential malware or backdoors installed during the visit. Organizations should update internal blocklists to include the domain and associated IP address to prevent future exposure.