823640-coinbase[.]com

This domain, 823640-coinbase.com, was used to impersonate Coinbase, a cryptocurrency exchange platform, in a phishing operation. Visitors to this site were likely presented with fraudulent login pages or prompts designed to harvest credentials, payment details, or other sensitive information. Such attacks often aim to gain unauthorized access to cryptocurrency wallets or financial accounts, leading to theft of funds or personal data. The domain’s design and structure closely mimic legitimate Coinbase properties, increasing the risk of deception for unsuspecting users. Analysis indicates the domain was created on August 17, 2025, and registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolved to the IP address 172.67.219.137, hosted on Cloudflare’s infrastructure (AS13335). Security vendors flagged the domain on VirusTotal, with 17 out of 95 engines detecting it as malicious. The domain also appeared on one security blocklist and was assigned a low-trust SSL certificate (WE1), further confirming its suspicious nature. The site has since been taken offline, but similar threats may persist. If you visited 823640-coinbase.com or entered any credentials, take immediate action. Disconnect the device from the internet and run a full antivirus scan to detect potential malware. Change passwords for Coinbase and any other accounts where the same credentials were used, enabling multi-factor authentication where possible. Monitor financial accounts and cryptocurrency wallets for unauthorized transactions. Report the incident to Coinbase’s official support channels and consider filing a report with local cybercrime authorities. Avoid clicking on links in unsolicited emails or messages, and verify domain authenticity before entering sensitive information.