350291-coinbase[.]com

This domain, 350291-coinbase.com, is a confirmed credential harvesting site targeting cryptocurrency users through brand impersonation of Coinbase. Analysis indicates the domain was designed to deceive visitors into entering sensitive account credentials, recovery phrases, or two-factor authentication codes by mimicking the legitimate Coinbase interface. The infrastructure employs technical deception tactics, including a fraudulent SSL certificate issued by PhishDestroy/botadmin.destroy.tools, to create a false sense of security for potential victims. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 21, 2026, with an anomalous future creation date suggesting possible domain squatting or advanced preparation. Security telemetry shows 15 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on three distinct security blocklists. Google Safe Browsing explicitly classifies the domain as phishing, and it currently resolves to the non-routable IP address 127.0.0.127, indicating recent takedown or sinkholing activity. Users who visited 350291-coinbase.com should immediately revoke any active sessions on legitimate cryptocurrency platforms and rotate all credentials associated with their accounts. Any entered recovery phrases or private keys must be considered compromised, requiring immediate transfer of funds to new wallets. System scans using updated security tools are recommended to detect potential secondary infections. Organizations should add the domain and its SSL certificate fingerprint to internal blocklists to prevent future access attempts.