coinbuseprologon[.]wixstudio[.]com

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the cryptocurrency exchange Coinbase. Analysis indicates the site mimics the Coinbase Pro interface, using the page title 'Coinbase Pro | Digital® Asset* Exchange' to lend credibility to the fraudulent operation. The threat type is classified as brand impersonation, with no direct evidence of credential theft or crypto drainer functionality at this time, though such capabilities cannot be ruled out in similar campaigns. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and is hosted on Wix’s platform, resolving to the IP address 34.144.206.118. The site employs a Let’s Encrypt SSL certificate and utilizes technologies including React, Google Cloud, Lodash, HSTS, and Google Cloud CDN. Detection metrics show 11 out of 95 security vendors on VirusTotal flagged the domain, while Gridinsoft assigned a trust score of 0/100. The domain appears on five security blocklists, including MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD, and has since been taken offline. Mitigation steps for this threat type include immediate blacklisting of the domain and associated IP address across enterprise security controls. Organizations should monitor for indicators of compromise, such as unusual login attempts or transactions originating from users who accessed the domain. End users should be educated on verifying domain authenticity, particularly for cryptocurrency platforms, and encouraged to enable multi-factor authentication. Security teams are advised to review logs for connections to 34.144.206.118 and inspect any related artifacts, such as cached pages or redirects, for further malicious activity.