supportcoinbase[.]es

This domain, supportcoinbase.es, poses a direct threat as a brand impersonation site targeting Coinbase users. The site mimics legitimate Coinbase branding to deceive visitors into disclosing sensitive account credentials, financial details, or installing malicious software under the guise of official support. Given the domain's association with cryptocurrency services, the risk extends to potential unauthorized transactions, account takeovers, or exposure to secondary payloads such as crypto drainers or remote access trojans. The lack of an SSL certificate further increases the likelihood of interception of any transmitted data, amplifying the risk of credential theft or session hijacking. Analysis of the domain reveals concrete indicators of malicious activity. The domain is flagged by 9 out of 95 security vendors on VirusTotal, a detection rate that exceeds typical thresholds for confirmed threats. It was registered through HOSTINGER operations, UAB, a registrar frequently observed in phishing campaigns targeting financial and cryptocurrency platforms. Infrastructure analysis indicates the domain resolves to the IP address 82.25.113.245, hosted on AS47583 (Hostinger International Limited) in France. The domain appears on one security blocklist, and its page title, 'Página por defecto,' suggests an incomplete or hastily deployed impersonation attempt, a common tactic to evade initial detection while maintaining operational readiness. Users who visited supportcoinbase.es should take immediate corrective actions to mitigate potential compromise. First, revoke any active sessions on Coinbase or associated cryptocurrency wallets and reset passwords using a device not previously connected to the malicious domain. Enable multi-factor authentication (MFA) if not already active, and monitor all linked accounts for unauthorized transactions or configuration changes. If financial details or recovery phrases were entered, contact Coinbase support to report the incident and request account freezing or transaction reviews. Additionally, scan the device used to access the domain for malware, focusing on browser extensions, keyloggers, or remote access tools. Given the domain's elevated risk level, affected users should assume credentials were exposed and act accordingly to prevent further exploitation.