privatelabel[.]es

This domain, privatelabel.es, is identified as a brand impersonation phishing site specifically targeting Coinbase, a cryptocurrency exchange platform. The phishing page, titled 'Notification Transaction,' mimics legitimate Coinbase communications to deceive users into disclosing sensitive credentials or authorizing fraudulent transactions. No explicit cryptocurrency drainer kit signatures were detected, though the presence of WordPress, PHP, and MySQL suggests a dynamically generated phishing framework capable of harvesting and exfiltrating user data in real time.

Infrastructure analysis reveals the domain resolves to the IP address 178.211.133.59 and is registered through ES-RAIOLANETWORKS-20220125 (ASN: 56958). The domain is secured with a Let’s Encrypt SSL certificate, a common tactic to lend false legitimacy. VirusTotal detection metrics indicate 4 out of 95 security vendors flagged the domain as malicious. The domain appears on one security blocklist and is associated with technologies including jQuery, Google Tag Manager, and HTTP/3, which may facilitate tracking and evasion. No Google Safe Browsing (GSB) listing was reported at the time of analysis.

As of the latest assessment, privatelabel.es has been taken offline, likely in response to security vendor reports or registrar enforcement actions. However, residual risk persists due to the potential reuse of the underlying infrastructure or migration of the phishing kit to newly registered domains. Users who interacted with the site are advised to revoke any active sessions, reset credentials, and monitor financial accounts for unauthorized activity. Organizations should update blocklists to include the domain and associated IP to prevent future exposure.