privacywallet-coinbase[.]com

This domain, privacywallet-coinbase.com, operates as a fraudulent login portal impersonating Coinbase, a major cryptocurrency exchange platform. The site is designed to harvest user credentials by presenting a visually identical sign-in interface, tricking victims into entering sensitive account details. Analysis of the infrastructure indicates a targeted brand impersonation campaign, likely intended to facilitate unauthorized access to cryptocurrency wallets or execute fraudulent transactions. The presence of a fake login page, combined with the absence of a valid SSL certificate, further confirms the malicious intent of this domain. Evidence supporting the classification of this domain as malicious includes multiple technical indicators. The domain was registered on November 30, 2025, through Metaregistrar BV, a registrar frequently associated with phishing infrastructure. It resolves to the IP address 185.158.133.1, hosted in Poland under AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate malicious activity. Security vendors on VirusTotal flagged the domain at a rate of 17 out of 95, and it appears on at least one security blocklist. Additionally, the page title, 'Coinbase - Sign-In,' directly mimics the legitimate platform, reinforcing its deceptive nature. Users who visited privacywallet-coinbase.com should take immediate action to mitigate potential risks. Those who entered credentials should assume their accounts are compromised and initiate a password reset on the legitimate Coinbase platform using a separate, secure device. Enable multi-factor authentication (MFA) if not already active, and monitor the account for unauthorized transactions or changes. If cryptocurrency was transferred or wallet details were shared, consider contacting the platform’s support team for further assistance. Additionally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads. Report the domain to relevant security teams or blocklist providers to aid in broader threat mitigation efforts.