login[.]coinbase[.]page

This report details a technical threat analysis for domain login.coinbase.page. The site was configured to impersonate the Coinbase cryptocurrency brand, as indicated by the page title "coinbase.page" and its classification as a cryptocurrency scam type. The threat posed is a credential harvesting or phishing operation designed to deceive users into providing sensitive account information for the legitimate Coinbase platform.

Technical analysis reveals that the domain registration was handled by registrar BODIS-A, with a primary IP address of 199.59.243.228 hosted on AS16509 Amazon.com, Inc. in the United States. VirusTotal scans returned 7 out of 95 detections, with flags from ChainPatrol, BitDefender, CRDF, CyRadar, and G-Data. The domain is listed on 1 blocklist. No SSL certificate was present, and no nameservers were found (NS_NOT_FOUND). The GridinSoft trust score is 0 out of 100.

The current status of the site is DOWN/OFFLINE, indicating it is no longer accessible. The overall risk level is assessed as very high, with a DOM risk score of 10, reflecting its malicious intent and the potential for financial loss. This domain should be blocked and monitored for any future reactivation.