guide-extnson-coinbes-x[.]square[.]site

This domain, guide-extnson-coinbes-x.square.site, is identified as a high-risk brand impersonation threat targeting Coinbase users. Analysis indicates the site mimics the official Coinbase Chrome extension page, presenting itself as a secure crypto wallet portal to deceive victims into disclosing login credentials or installing malicious browser extensions. The page title, 'Coinbase Chrome Extension – Secure Crypto Wallet | Coinbase.com | Sign In,' directly replicates Coinbase branding, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain resolves to IP address 74.115.51.4, hosted on AS27647 (Weebly, Inc.) in the United States. It was registered on February 05, 2019, through MarkMonitor, Inc., and secured with a Let's Encrypt SSL certificate (serial E7). Google Safe Browsing explicitly flags the domain as phishing, while VirusTotal reports 16 out of 95 security vendors detecting malicious activity. The domain also appears on one additional security blocklist, further validating its fraudulent nature. As of the latest assessment, guide-extnson-coinbes-x.square.site has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk persists due to the domain's historical use in credential theft campaigns. Organizations and users are advised to monitor for related infrastructure, including domains with similar naming patterns or shared hosting providers. Blocking the associated IP (74.115.51.4) and implementing strict access controls for crypto-related services can mitigate future exposure. Continuous vigilance is recommended, as threat actors frequently repurpose infrastructure for new attacks.