protocol-3[.]ghost[.]io

This domain, protocol-3.ghost.io, is identified as a brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. Analysis confirms the domain was actively used to mimic Coinbase’s official branding, likely to deceive users into disclosing sensitive credentials or transferring assets. The site is currently offline, but prior activity suggests it operated as a phishing endpoint designed to harvest login details or facilitate unauthorized transactions. Infrastructure analysis reveals the domain was flagged by 1 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. It was registered through 1API GmbH on October 01, 2011, though recent malicious activity suggests either a compromise or repurposing of an older domain. The domain resolved to the IP address 151.101.131.7 and employed technologies such as Varnish, Nginx, and OpenResty, alongside a Let’s Encrypt SSL certificate to appear legitimate. It appeared on one security blocklist and received a trust score of 0/100 from Gridinsoft, further corroborating its malicious nature. While protocol-3.ghost.io is currently offline, organizations and users should remain vigilant. Historical DNS records and cached content may still pose risks if accessed inadvertently. It is recommended to block the domain and its associated IP at the network level, monitor for related phishing campaigns, and educate users on recognizing brand impersonation tactics. Security teams should review logs for connections to 151.101.131.7 and investigate any interactions with the domain to assess potential exposure.