hub-coinbaze[.]wixstudio[.]com

This domain, hub-coinbaze.wixstudio.com, is identified as a brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site mimics Coinbase Wallet’s onboarding process, presenting a page titled 'Coinbase Extension® — Getting Started | Coinbase Wallet®' to deceive users into interacting with fraudulent wallet extensions. No explicit crypto drainer kit signatures were detected, but the infrastructure aligns with common brand impersonation tactics used to harvest credentials or distribute malicious browser extensions. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 8 out of 95 security vendors on VirusTotal, registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. The domain was created on April 20, 2026, an anomalous future date suggesting potential manipulation or misconfiguration. It is currently blocked by one security blocklist and was not listed on Google Safe Browsing at the time of assessment. The site employed a Let’s Encrypt SSL certificate and utilized technologies including Wix, React, Google Cloud, and HTTP/3, which may have been leveraged to enhance legitimacy. The domain has since been taken offline, reducing immediate user exposure. However, residual risk persists due to the domain’s recent activity and the potential for infrastructure reuse under similar naming schemes. Organizations and users are advised to monitor for recurring impersonation attempts targeting Coinbase or related wallet services, particularly those hosted on content management platforms. Blocklist integration and DNS-level filtering are recommended to mitigate future threats from this actor or associated infrastructure.