tidua-coinbase[.]com

The domain tidua-coinbase.com poses a significant threat as a brand impersonation of Coinbase, a well-known cryptocurrency exchange platform. This domain is designed to deceive users into believing they are interacting with a legitimate Coinbase service, potentially leading to the theft of personal information, including login credentials and financial data.

Analysis indicates that tidua-coinbase.com was registered on June 25, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar that may be associated with malicious activities. The domain has been flagged by 4 out of 95 security vendors on VirusTotal, suggesting that while it is not yet widely recognized, it has been identified by some advanced detection systems. Additionally, the domain has appeared in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious intent. The SSL certificate is issued by Let's Encrypt, which is a common tactic used by threat actors to gain user trust and avoid initial detection. The domain currently resolves to the IP address 178.16.54.253, which should be treated with caution.

If users have visited tidua-coinbase.com, it is crucial to take immediate action to protect their personal and financial information. They should change their Coinbase login credentials and any other sensitive information that may have been entered on the site. Additionally, users should monitor their accounts for any unauthorized activity and consider enabling two-factor authentication (2FA) if it is not already active. Reporting the incident to Coinbase's support team and to local cybersecurity authorities is also recommended to help mitigate the impact of this threat.