ssomycoinbasepro[.]wixstudio[.]com

The domain ssomycoinbasepro.wixstudio.com poses a high risk and is specifically flagged as a brand impersonation threat targeting Coinbase. This domain has been used to deceive users into believing they are interacting with a legitimate Coinbase service, potentially leading to credential theft or financial loss.

Analysis indicates that the domain was registered through GoDaddy.com, LLC, and has been flagged by 10 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain resolves to the IP address 34.144.206.118, which may be associated with malicious activities. The domain was created on December 17, 2016, indicating a long-standing presence that could have been used for multiple campaigns. The trust score from Gridinsoft is 0 out of 100, indicating a complete lack of trust in the domain's legitimacy. Additionally, the domain appears on five security blocklists and is blocked by MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD. The SSL certificate is issued by Let's Encrypt, which is a common practice for phishing domains to appear more legitimate to unsuspecting users.

To mitigate the risks associated with this brand impersonation threat, users are advised to verify the URL of any Coinbase-related services they access. They should only use official Coinbase URLs and avoid clicking on links from untrusted sources. Security teams should update their blocklists to include this domain and its associated IP address, 34.144.206.118. Additionally, implementing DNS-based filtering and educating users on the signs of phishing attacks can significantly reduce the likelihood of successful impersonation attempts.