mail[.]login-coinbase[.]net

This domain impersonates Coinbase, a cryptocurrency exchange platform, to deceive users into entering login credentials, financial details, or other sensitive information. The site mimics the official Coinbase interface, including the page title 'Coin base – Buy & Sell Crypto,' to appear legitimate and trick victims into disclosing account access or personal data. Such attacks often lead to unauthorized transactions, identity theft, or further exploitation through compromised accounts. Analysis indicates this domain was registered on November 17, 2025, through Tucows Domains Inc., and resolves to the IP address 190.92.174.188, hosted by WHG Hosting Services Ltd in India. It is flagged by 18 out of 95 security vendors on VirusTotal, appears on two security blocklists, and is marked as phishing by Google Safe Browsing. The absence of an SSL certificate further signals its malicious nature, as legitimate financial services universally enforce encrypted connections. If you visited this domain or entered any information, immediately reset your Coinbase account password and enable multi-factor authentication if not already active. Review recent account activity for unauthorized transactions and report any suspicious behavior to the official support channels. Monitor linked financial accounts for signs of fraud and consider placing a fraud alert with credit bureaus if personal details were exposed. Avoid clicking on links in unsolicited messages, even if they appear to originate from known services, and verify domain authenticity before entering credentials.