coinbaseupgrade[.]com

This domain, coinbaseupgrade.com, poses a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. The site is designed to deceive users into believing they are interacting with an official Coinbase portal, likely for the purpose of credential theft or unauthorized transaction manipulation. Analysis indicates the domain is structured to exploit trust in the Coinbase brand, potentially leading to financial loss or account compromise for unsuspecting visitors. Infrastructure analysis reveals multiple red flags supporting this assessment. The domain was registered on December 25, 2025, through GoDaddy.com, LLC, and resolves to the IP address 13.248.243.5, hosted within Amazon.com, Inc.'s infrastructure (AS16509). Security vendors on VirusTotal flag the domain at a concerning rate of 17 out of 95, while it appears on three distinct security blocklists. The SSL certificate, issued by Let's Encrypt (R13), provides minimal assurance, as fraudulent sites commonly abuse free certificate authorities to appear legitimate. Additionally, the domain is actively blocked by multiple security mechanisms, including PhishDestroy, MetaMask, and SEAL, further validating its malicious intent. Users who have visited coinbaseupgrade.com should take immediate action to mitigate potential risks. First, terminate any active sessions with the domain and avoid entering credentials or sensitive information. If login details were submitted, reset passwords for Coinbase and any other accounts where the same credentials may have been reused. Monitor financial transactions and account activity for unauthorized changes. Employ multi-factor authentication where available to add an additional layer of security. Finally, report the domain to relevant security teams or incident response platforms to aid in broader threat mitigation efforts.