149561coinbase[.]com

This domain is flagged as a high-risk credential-theft phishing site specifically targeting Coinbase users. The infrastructure is designed to harvest login credentials through brand impersonation, as evidenced by the page title 'Sign in' and the domain's construction mimicking the legitimate Coinbase platform. Analysis indicates a deliberate attempt to deceive users into submitting sensitive authentication details under false pretenses. Infrastructure analysis reveals the domain was registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 45.137.198.27, hosted by RoyaleHosting BV in the Netherlands. The SSL certificate is issued by Let's Encrypt (serial number E8), a common tactic to lend superficial legitimacy to malicious sites. The domain appears on three security blocklists and is flagged by 10 out of 95 security vendors on VirusTotal, including detections from PhishDestroy, MetaMask, and SEAL. The creation date, registrar, and hosting provider align with known patterns of phishing infrastructure. Mitigation requires immediate blocking of the domain and associated IP address across all network security controls. Organizations should deploy indicators of compromise (IOCs) including the domain, IP, and SSL certificate fingerprint to endpoint detection systems. User awareness training should emphasize verifying domain authenticity before entering credentials, particularly for financial platforms. Security teams are advised to monitor for credential reuse attempts stemming from harvested data and implement multi-factor authentication (MFA) as a compensatory control for compromised accounts.