343243-coinbase[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. The site mimics legitimate Coinbase branding to deceive users into disclosing sensitive credentials or transferring cryptocurrency to attacker-controlled wallets. Analysis indicates the domain is designed to exploit trust in the Coinbase brand, likely for credential harvesting or crypto drainer attacks. Infrastructure analysis reveals the domain was registered on December 07, 2025, through NiceNIC International Group Co., Limited. It resolves to IP address 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.), and lacks an SSL certificate. VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Google Safe Browsing categorizes it as phishing, and the page title is identical to the legitimate Coinbase site, further confirming its impersonation intent. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP (188.114.96.3) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to the domain. Users who may have interacted with the site should be instructed to reset credentials for Coinbase and any other accounts where the same credentials were reused. Additionally, monitoring for anomalous cryptocurrency transactions linked to compromised accounts is recommended. Security teams should review logs for connections to the domain or IP to identify potential breaches.