1ogin7[.]am[.]coinbase[.]com[.]ph

The domain 1ogin7.am.coinbase.com.ph has been identified as a confirmed brand impersonation phishing site specifically targeting Coinbase users. Currently offline, this domain attempted to deceive visitors by presenting a page titled "Coinbase Netherlands - bitcoins, ethereum en meer in het volste vertrouwen kopen en verkopen" to steal login credentials and personal information. PhishDestroy's analysis reveals that this is a sophisticated impersonation attempt leveraging the Coinbase brand to gain trust.

Technical indicators paint a clear picture of malicious intent. VirusTotal flagged the domain with 4 out of 95 security vendors raising alerts, and it appears on one security blocklist. The domain was registered through NL-LEASEWEB-20120124 (ASN 60781) and resolves to IP address 172.64.152.241. Its SSL certificate is issued by Let's Encrypt (R12), a common choice among phishing operators for its free and automated issuance. These details, combined with the obvious brand impersonation in the page title, confirm the domain's fraudulent nature.

Although the site is currently offline, users should remain vigilant. PhishDestroy strongly advises avoiding any interaction with this domain or similar variations. If you have already entered credentials or personal information on this site, change your Coinbase password immediately, enable two-factor authentication, and monitor your accounts for unauthorized activity. Always verify URLs carefully before logging in, and report suspicious domains to security teams and anti-phishing organizations.