sso-coinbase-x-cdn[.]tem3[.]io

PhishDestroy identifies sso-coinbase-x-cdn.tem3.io as an active Coinbase impersonation domain engineered to steal cryptocurrency through a fraudulent single sign-on (SSO) login portal. This site masquerades as Coinbase's SSO system while operating under a recently registered domain designed to trick users into entering wallet credentials or connecting malicious browser extensions that drain funds. The domain exhibits clear red flags including social engineering indicators flagged by Google Safe Browsing, with MetaMask already blocking access to prevent wallet compromise. Users attempting to access Coinbase services should verify the correct domain (coinbase.com) and never trust third-party SSO portals without direct verification. This domain was flagged after being created on August 02, 2024, through GoDaddy.com, LLC, resolving to IP address 188.114.97.3. Current intelligence shows it exists on one active security blocklist while maintaining a clean VirusTotal report with 0 detections out of 95 scanners. Despite lacking immediate antivirus detection, the domain's SSL certificate issued by Google Trust Services and its use of tem3.io as a subdomain structure suggest an attempt to appear legitimate while operating outside Coinbase's official infrastructure. The presence of social engineering flags from Google Safe Browsing indicates active attempts to deceive users through fake login interfaces. If you've visited sso-coinbase-x-cdn.tem3.io, immediately disconnect any connected wallets, revoke any approved permissions, and scan for malicious browser extensions. Verify all Coinbase-related links through official channels before providing any credentials. Consider using hardware wallets for additional protection against crypto drainers. Report the domain to your browser's security team and consider changing passwords if you entered any information. PhishDestroy recommends bookmarking official Coinbase domains and using browser security extensions to block known malicious sites.