admin[.]coinbasee[.]one

This domain, admin.coinbasee.one, poses a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic legitimate Coinbase login portals, likely to harvest user credentials or facilitate unauthorized account access. The page title, rendered in Chinese as "没有找到站点" (translation: "Site not found"), suggests either a placeholder or a localized phishing attempt, though the domain infrastructure and registration details confirm malicious intent. The threat type aligns with known tactics used to deceive users into entering sensitive information, which could lead to financial theft or account compromise. Technical indicators strongly support the classification of this domain as malicious. The domain was registered on March 25, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with suspicious domains. It resolves to the IP address 143.92.40.204, located in Hong Kong and hosted by Rackip Consultancy Pte. LTD, an entity with a history of hosting phishing infrastructure. VirusTotal detection rates show 19 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing has explicitly marked it as phishing. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R12), was likely used to lend a false sense of legitimacy to the fraudulent site. The domain has since been taken offline, though its prior activity remains a concern. Users who visited admin.coinbasee.one or interacted with its content should take immediate remediation steps. Any credentials entered on the site must be considered compromised and should be changed immediately across all platforms where the same or similar passwords were used. Affected individuals should enable multi-factor authentication on their Coinbase accounts and monitor for unauthorized transactions or login attempts. If financial data or cryptocurrency wallet information was submitted, users are advised to contact their financial institution or wallet provider to report potential fraud. Additionally, scanning the device used to access the domain for malware is recommended, as phishing sites may deploy additional payloads to maintain persistence or exfiltrate data.