web[.]coinbase-china[.]info

This domain is flagged as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. The site presents itself as a legitimate trading portal under the title 'exchange,' designed to deceive users into entering sensitive credentials or transferring digital assets. Analysis indicates the threat type aligns with credential harvesting and potential cryptocurrency theft, leveraging trusted branding to exploit user trust. Infrastructure analysis reveals the domain web.coinbase-china.info resolves to the IP address 54.179.238.221, hosted on Amazon Web Services (AWS) in the ap-southeast-1 region (Singapore). The domain was registered through Web Commerce Communications Limited (WebNic.cc), a registrar commonly associated with malicious domains due to its lenient registration policies. Detection metrics show 6 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing and one additional blocklist have classified it as phishing. The SSL certificate, issued by Let's Encrypt (serial number E7), provides minimal assurance, as it is frequently abused by threat actors to lend a false sense of legitimacy to fraudulent sites. The domain remains active as of this assessment, with no evidence of takedown or mitigation. To mitigate risks associated with this threat, users should avoid interacting with the domain or any associated links. Organizations should implement domain-based blocking at the network level, specifically targeting web.coinbase-china.info and its resolving IP (54.179.238.221). Endpoint protection systems should be updated to recognize the domain and its indicators of compromise. Users who may have engaged with the site should immediately revoke any active sessions, reset credentials for Coinbase and linked accounts, and monitor for unauthorized transactions. Cryptocurrency wallet addresses associated with the domain should be flagged and reported to relevant blockchain analysis platforms for further tracking.