928525coinbase[.]com

This domain, 928525coinbase.com, is actively engaged in credential harvesting operations targeting users of the Coinbase cryptocurrency exchange platform. The site mimics the legitimate Coinbase login interface to deceive victims into submitting their account credentials, two-factor authentication codes, and other sensitive authentication details. Analysis indicates this infrastructure is designed to capture and exfiltrate user credentials for subsequent unauthorized access to cryptocurrency wallets and financial accounts. The domain poses a significant risk of financial theft, identity compromise, and unauthorized transactions on the Coinbase platform and associated services. Infrastructure analysis reveals the domain was registered on July 07, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domain registrations. The domain resolves to the IP address 188.114.97.3 and is protected by Cloudflare, which obscures the true hosting origin. Security vendor detection on VirusTotal shows 14 out of 95 engines flagging the domain as malicious, while it appears on at least one security blocklist. The site employs HTTP/3 and utilizes an SSL certificate issued by Google Trust Services, adding a veneer of legitimacy to the phishing operation. Users who have visited 928525coinbase.com or entered credentials on the site should immediately take corrective actions. First, revoke any active sessions on the legitimate Coinbase platform and change account passwords using a secure, unrelated device. Enable multi-factor authentication if not already active, and monitor account activity for unauthorized transactions. Report the incident to the legitimate service provider and consider notifying relevant financial authorities or cybersecurity incident response teams. The domain remains active as of this analysis, and users should avoid any interaction with it or related infrastructure.