coinbase-436134[.]com

This domain, coinbase-43613.com, poses a high-risk credential theft threat by impersonating the Coinbase cryptocurrency exchange platform. The site presents a fraudulent login page titled 'Recovery - Sign In | Coinbase,' designed to harvest user credentials, including usernames, passwords, and potentially multi-factor authentication codes. Such attacks often lead to unauthorized account access, financial theft, or further exploitation through secondary phishing or malware distribution. Users encountering this domain may unknowingly expose sensitive information, enabling attackers to compromise linked wallets or other financial services. Analysis indicates the domain was registered on May 18, 2026, through Name.com, Inc., a registrar frequently observed in phishing campaigns. It resolved to the IP address 216.198.79.65, hosted under Cypress Communications, LLC in the United States, and utilized a Let's Encrypt SSL certificate (R13) to mimic legitimacy. Detection metrics reveal that 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on three distinct security blocklists. Additional protections, including browser-based and wallet-specific filters, have since blocked access to the site, which is now offline. Individuals who visited coinbase-43613.com should immediately revoke any active sessions on the legitimate Coinbase platform and change their account credentials. Enable multi-factor authentication if not already active, and monitor linked financial accounts for unauthorized transactions. If credentials were entered, consider the account compromised and contact the platform’s support team for further remediation. Avoid interacting with unsolicited links or emails claiming affiliation with cryptocurrency services, and verify domain authenticity through official channels before entering sensitive information.