login[.]coinbase[.]now

This domain, login.coinbase.now, represents a confirmed brand impersonation campaign targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site is designed to deceive users into entering legitimate credentials by mimicking the official Coinbase login interface. The primary threat posed by this domain is credential theft, which could lead to unauthorized access to cryptocurrency wallets, financial loss, and potential follow-on attacks such as account takeovers or secondary phishing attempts against contacts of compromised users. The page title 'coinbase.now' further reinforces the deception by closely associating itself with the legitimate brand.

Technical indicators confirm the malicious nature of this domain. As of the latest scan, login.coinbase.now is flagged by 2 out of 95 security vendors on VirusTotal, a relatively low detection rate that may reflect evasion techniques or recent deployment. The domain resolves to the IP address 199.59.243.228 and was registered through BODIS-A (ASN: 16509), a registrar frequently associated with low-reputation domains. Infrastructure analysis reveals the domain appears on at least one security blocklist, and Gridinsoft assigns it a trust score of 0/100, indicating high risk. The domain is currently offline, which may suggest takedown efforts or temporary suspension by the threat actor.

Users who visited login.coinbase.now or entered credentials on the site should take immediate action to mitigate potential risks. First, all passwords associated with the affected account should be changed, prioritizing accounts linked to cryptocurrency or financial services. Multi-factor authentication (MFA) should be enabled if not already active, using app-based or hardware tokens rather than SMS-based methods. Affected users are advised to monitor their accounts for unauthorized transactions or suspicious activity and report any anomalies to the legitimate service provider. Additionally, system scans for malware are recommended, as credential theft sites may deploy secondary payloads. If financial loss is suspected, users should contact their financial institution and relevant authorities to initiate fraud investigations.