coinlbasekr[.]app-lob[.]site

The domain coinlbasekr.app-lob.site has been identified as a high-risk phishing infrastructure specifically targeting Coinbase users through brand impersonation. The site is currently offline but was actively used to harvest account credentials under the guise of a Coinbase account creation page, as indicated by the page title "Coinbase - 계정 만들기". Analysis of the domain reveals it was registered through HOSTINGER operations, UAB, and resolved to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). The domain was created on February 21, 2026, and has been flagged by 17 of 95 security vendors on VirusTotal. It appears on three security blocklists and is recognized as a phishing threat by Google Safe Browsing. No SSL certificate was present, further reducing its legitimacy. Detection systems such as PhishDestroy, MetaMask, and SEAL have blocked access to this domain due to its malicious intent. The domain has since been taken offline, but similar infrastructure may reappear under different names. Organizations and users are advised to monitor for domains mimicking Coinbase branding, particularly those with unusual subdomains or recent creation dates. Network-level blocking of the IP 188.114.96.3 and domains registered through the same registrar should be considered. End users should verify the authenticity of any Coinbase-related communication by accessing the platform directly through official channels rather than following links from unsolicited messages.