coinbase-bitcoin-com-07533[.]tastfapidin197330[.]workers[.]dev

This domain represents a sophisticated brand impersonation operation designed to harvest cryptocurrency wallet credentials and personal authentication details from unsuspecting users. Analysis indicates the site mimics Coinbase's official interface, employing visual and functional elements that closely resemble the legitimate platform's login, verification, and transaction pages. The primary threat vector involves tricking users into entering their wallet credentials, two-factor authentication codes, and recovery phrases, which are then captured by threat actors for unauthorized account access and fund theft. The site may also distribute malware under the guise of wallet software updates or security plugins, further compromising victims' devices and financial security. Infrastructure analysis reveals multiple high-confidence indicators supporting the malicious classification. The domain was registered on May 15, 2024, through Cloudflare's workers.dev platform, a common tactic to leverage reputable infrastructure while maintaining operational anonymity. VirusTotal detection metrics show 12 out of 95 security vendors flagging the domain as malicious, with specific classifications including phishing, brand impersonation, and cryptocurrency fraud. The domain resolves to IP address 172.67.145.204 and employs Google Trust Services SSL certificates, creating a false sense of legitimacy. Additional technical indicators include the presence of HTTP Strict Transport Security (HSTS) headers and HTTP/3 protocol implementation, which are often used to bypass basic security checks and appear more authentic to both users and automated detection systems. Users who may have interacted with this domain should take immediate protective measures to mitigate potential compromise. First, revoke any active sessions and reset credentials for Coinbase and all associated cryptocurrency accounts, using a separate, secure device for these actions. Enable multi-factor authentication with hardware-based tokens or authenticator apps rather than SMS-based methods. Scan all devices used to access the site with updated security tools to detect potential malware infections. Monitor financial accounts and transaction histories for unauthorized activity, and consider placing fraud alerts with relevant financial institutions. Report the incident to the targeted platform's security team and relevant cybercrime authorities to assist in tracking and disrupting the threat actor's operations. The domain's current offline status does not eliminate risk, as stolen credentials may be used in future attacks or sold on underground markets.