2073-coinbase[.]com

This domain, 2073-coinbase.com, is an active phishing site designed to impersonate Coinbase, a cryptocurrency exchange platform. The site mimics legitimate Coinbase login pages to harvest user credentials, including usernames, passwords, and two-factor authentication codes. Analysis indicates the infrastructure is engineered to bypass initial security checks, as evidenced by its use of a valid SSL certificate issued by Google Trust Services and hosting behind Cloudflare’s network. The threat primarily targets individuals attempting to access their cryptocurrency accounts, with the intent to drain wallets or conduct fraudulent transactions once credentials are obtained. Evidence supporting the malicious nature of this domain includes its recent creation date of June 17, 2026, and registration through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with phishing campaigns. Security vendors on VirusTotal have flagged the domain as malicious, with 4 out of 95 engines detecting it as a phishing threat. Additionally, the domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, which is part of Cloudflare’s network (AS13335), a common tactic to obscure the true origin of the phishing server. Users who have visited 2073-coinbase.com or entered credentials on the site should assume their account information has been compromised. Immediate steps include changing passwords for Coinbase and any other accounts using the same credentials, enabling multi-factor authentication if not already active, and monitoring account activity for unauthorized transactions. Affected individuals should also revoke access to any linked applications or API keys and consider reporting the incident to relevant financial authorities. The domain remains active as of this advisory, and users are advised to avoid interaction with any communications or links associated with 2073-coinbase.com.