coinbaselog[.]com

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the Argent cryptocurrency wallet. Analysis indicates the domain specifically targets individuals by mimicking Coinbase’s authentication interface, including sign-up and login portals, to harvest wallet credentials, recovery phrases, and private keys. The threat type falls under credential theft and cryptocurrency wallet compromise, with potential secondary risks including unauthorized transactions and account takeovers. Infrastructure analysis reveals the domain coinbaselog.com was registered on May 20, 2025, through HOSTINGER operations, UAB. It resolves to the IP address 104.21.22.252, hosted on Cloudflare’s network (AS13335). The domain appears on three security blocklists and is actively blocked by multiple cryptocurrency security tools. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued under the identifier WE1, which lacks the extended validation typically associated with legitimate financial platforms. The page title, 'Coinbase Explore | Sign up | Login | Learn | Businesses | Download - coinbase,' closely mirrors official Coinbase branding, further confirming its intent to deceive. Mitigation steps for this threat type include immediate domain blacklisting at the network and endpoint levels. Security teams should update web filters to block coinbaselog.com and monitor for related domains using similar naming conventions. Users who may have interacted with the domain should revoke active sessions, rotate credentials, and verify wallet integrity for unauthorized transactions. Organizations should conduct retrospective log analysis to identify any prior exposure to the domain or its associated IP address. Given the domain’s current offline status, continuous monitoring for reactivation or migration to new infrastructure is recommended.