app[.]wallet[.]coinbase[.]synthfy[.]us

The domain app.wallet.coinbase.synthfy.us is identified as a high-risk phishing resource specifically designed for brand impersonation targeting Coinbase, a major cryptocurrency exchange platform. Analysis confirms the domain was actively used to mimic the official Coinbase Wallet interface, as evidenced by the page title 'Wallet Coinbase Wallet.' The domain is currently offline, though its infrastructure remains documented for ongoing threat assessment. Infrastructure analysis reveals the domain was registered on April 17, 2024, through NameCheap, Inc., and resolves to the IP address 23.235.218.39, hosted under AS22611 (InMotion Hosting, Inc.) in the United States. Detection metrics indicate significant security vendor consensus, with 15 of 95 VirusTotal engines flagging the domain as malicious. Google Safe Browsing has also classified the domain under phishing categories. The domain appears on at least one security blocklist, and its SSL certificate, issued by Let's Encrypt (R12), does not mitigate the inherent risk of credential harvesting or financial fraud. Current status indicates the domain has been taken offline, though residual risk persists for users who may have engaged with the resource prior to its deactivation. Organizations and individuals are advised to block the domain and associated IP address (23.235.218.39) at the network perimeter. Users who accessed the domain should immediately revoke any active sessions, rotate credentials, and monitor accounts for unauthorized transactions. Security teams should review logs for connections to the domain or IP to identify potential compromise. Proactive monitoring of newly registered domains with similar naming patterns (e.g., 'coinbase' + third-level subdomains) is recommended to preempt future impersonation attempts.