cpcalendars[.]165-227-27-180[.]cprapid[.]com

The phishing domain cpcalendars.165-227-27-180.cprapid.com is designed to impersonate Coinbase, a popular cryptocurrency exchange platform. It was flagged by two out of 95 vendors on VirusTotal, indicating some recognition of its malicious intent. The domain is currently offline, reducing its immediate threat, but its previous activity highlights the ongoing risk of credential phishing attacks.

This domain was registered through TUCOWS.COM, CO. and hosted on an IP address owned by DigitalOcean in the United States. The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its ease of use and free availability. The page title "Coinbase - Sign In" was likely used to deceive users into entering their credentials, which could then be harvested by attackers.

PhishDestroy, along with MetaMask and SEAL, has listed this domain on public blocklists, reflecting its recognized threat level. The platform risk score of 63/100 further underscores the potential danger it posed before being taken offline. This case illustrates the importance of timely detection and response to phishing domains, as they can exploit the gap between registration and detection by antivirus databases. PhishDestroy's early detection capabilities play a crucial role in identifying such threats during this critical window.