cpcontacts[.]20-120-116-237[.]cprapid[.]com

The domain cpcontacts.20-120-116-237.cprapid.com is a high-risk brand impersonation threat targeting Coinbase. It is currently active and poses a significant risk to users who may be tricked into divulging sensitive information such as login credentials or financial data.

Analysis indicates that the domain is flagged by 8 out of 95 VirusTotal security vendors, suggesting a moderate level of detection. The domain is registered through Tucows Domains Inc. and resolves to the IP address 20.120.116.237, which is located in the United States and is part of the Microsoft Corporation's AS8075. The domain appears on 3 security blocklists, further indicating its malicious intent. The SSL certificate is issued by Let's Encrypt, and the page title is set to 'Coinbase - Sign In,' which is a clear attempt to mimic the legitimate Coinbase login page.

Given the current active status of the domain, it is recommended that security teams and users take immediate action to block this domain at the network and browser levels. Additionally, users should be educated to verify the URL and SSL certificate of the Coinbase website before entering any sensitive information. Security professionals should monitor for any further indicators of compromise and ensure that their threat intelligence feeds are updated with this domain.