coin-base-pro-login-faq[.]tem3[.]io

This domain is flagged as a high-risk brand impersonation threat targeting Coinbase users through a fake login portal. Analysis indicates the site was designed to harvest credentials by presenting itself as the official Coinbase Pro platform, as evidenced by the page title 'Official Site® | Coinbase Pro |' and its deceptive infrastructure. Infrastructure analysis reveals the domain coin-base-pro-login-faq.tem3.io was registered on August 02, 2024, through GoDaddy.com, LLC. It resolved to the IP address 188.114.97.3, hosted on CloudFlare infrastructure in Canada, a common tactic to obscure origin. Security vendors on VirusTotal flagged the domain with 17/95 detections, while Google Safe Browsing classified it as phishing. The SSL certificate, issued by Google Trust Services (WE1), provided a false sense of legitimacy. The domain appeared on one security blocklist and was subsequently blocked by PhishDestroy after being identified as malicious. Mitigation steps for this type of threat include immediate credential rotation for any users who may have interacted with the site, particularly those with access to cryptocurrency wallets or exchange accounts. Organizations should update blocklists to include the domain and associated IP address 188.114.97.3 to prevent future access. Security teams are advised to monitor for similar impersonation patterns, such as lookalike domains registered through GoDaddy or other high-volume registrars, and enforce multi-factor authentication to reduce the impact of credential theft. Given the domain's current offline status, further monitoring of related infrastructure is recommended to identify potential resurgence or lateral movement in the threat actor's operations.