coinbasez[.]st

coinbasez.st is an active brand impersonation site targeting Coinbase users, posing as a legitimate login portal to steal credentials. This domain operates under an elevated risk classification due to its direct mimicry of Coinbase’s branding and login interface. PhishDestroy identifies this as a credential harvesting phishing site designed to deceive victims into entering sensitive account details under false pretenses.

This domain was flagged by PhishDestroy and detected by VirusTotal with 1 out of 95 security vendors identifying it as malicious. It was registered through Gname, a domain registrar often associated with high-risk or malicious registrations due to lax oversight. The site resolves to IP address 104.21.56.147, which is linked to hosting infrastructure frequently abused by phishing campaigns. While the exact registration date is not publicly available, the domain’s behavior and infrastructure alignment strongly suggest recent deployment as part of an active campaign. Despite low detection rates, the specificity of the impersonation and infrastructure alignment indicate a targeted, evolving threat rather than a generic phishing attempt.

Users should avoid interacting with coinbasez.st entirely, as it is a confirmed fake login portal. If you suspect exposure, immediately change your Coinbase password using the official website or app, enable two-factor authentication (2FA), and review account activity for unauthorized transactions. Report the domain to Coinbase’s abuse team and your local cybersecurity authority. Organizations are advised to block this domain at the network level and educate users about verifying URLs before entering credentials. Always access financial platforms via official domains and use bookmarks or trusted links to prevent falling victim to lookalike domains.