secured-support-coinbase[.]com

This domain, secured-support-coinbase.com, poses a high-risk brand impersonation threat specifically targeting Coinbase users. Analysis indicates the site is designed to mimic legitimate Coinbase support pages, likely to deceive victims into disclosing account credentials, wallet recovery phrases, or other sensitive information. The domain may also host crypto drainer scripts or fake login portals, given its association with known phishing infrastructure and the use of a 'Coming Soon' placeholder page, which is a common tactic to delay detection while preparing malicious content. Evidence supporting this assessment includes multiple technical indicators. The domain was registered on February 21, 2026, through Squarespace Domains II LLC, a registrar frequently abused for phishing campaigns. It resolves to the IP address 198.49.23.144, hosted on AS53831 (Squarespace, Inc.), and is flagged by 20 out of 95 security vendors on VirusTotal. Additionally, the domain appears on three security blocklists, and its SSL certificate is issued by Let's Encrypt (R12), a common choice for malicious actors due to its low-cost and automated issuance process. Users who have visited secured-support-coinbase.com should immediately cease all interaction with the domain. If any credentials, wallet addresses, or recovery phrases were entered, affected individuals must revoke access to any linked accounts, rotate passwords, and monitor for unauthorized transactions. Browser sessions should be cleared, and systems scanned for malware using updated security tools. Given the domain's active status and high-risk classification, users are advised to report the site to their security providers and relevant abuse contacts, such as those for Squarespace and Let's Encrypt, to aid in takedown efforts.