eeszlkfrmmpcxprm[.]sukxhj[.]tacorsa[.]com

eeszlkfrmmpcxprm.sukxhj.tacorsa.com is a confirmed brand impersonation phishing site specifically targeting Coinbase users, and it has currently been taken offline. This domain was designed to deceive visitors into believing they were accessing legitimate Coinbase services, aiming to harvest sensitive credentials and financial information. The page title explicitly displayed 'Coinbase', reinforcing the fraudulent appearance.

PhishDestroy analysis uncovered that this domain was flagged by 4 out of 95 security vendors on VirusTotal, indicating a moderate level of detection among security communities. It was registered through Wild West Domains, LLC on May 13, 2026, and resolved to IP address 20.197.43.226. The site used an SSL certificate issued by Let's Encrypt (E8), which is common for both legitimate and malicious sites, adding a veneer of false legitimacy. Three separate security blocklists had already identified this domain as a threat prior to its takedown.

Although the domain is now offline, users who may have encountered it should exercise caution. It is recommended to change any passwords entered on the site immediately, enable two-factor authentication on Coinbase accounts, and monitor accounts for unauthorized transactions. PhishDestroy advises reporting any similar domains to relevant authorities and avoiding interaction with unsolicited links claiming to be from Coinbase. Always verify URLs directly by typing the official domain into the browser rather than clicking on links from emails or messages.