recall-coinbase[.]com

This domain, recall-coinbase.com, poses a direct credential harvesting threat to Coinbase account holders through brand impersonation. Analysis of the page structure reveals a fraudulent 'Sign In' interface designed to mimic legitimate Coinbase authentication portals, tricking users into submitting login credentials and potentially two-factor authentication codes. The domain specifically targets users seeking to access their cryptocurrency accounts, with the potential to facilitate unauthorized account access and financial theft. Infrastructure analysis provides multiple indicators of malicious intent. The domain was registered on November 12, 2025, through OwnRegistrar, Inc., and currently appears on one security blocklist. VirusTotal detection shows 17 out of 95 security vendors flagging the domain as malicious. The domain resolves to IP address 91.215.85.148 (AS200593 PROSPERO OOO) located in Russia, and uses an R12 SSL certificate. The combination of recent registration, brand impersonation, and hosting infrastructure in a high-risk jurisdiction aligns with known phishing campaign patterns. Users who visited recall-coinbase.com should immediately take protective measures. First, reset Coinbase account passwords using a different device and enable all available security features, including hardware-based two-factor authentication. Second, review account activity for unauthorized transactions or configuration changes. Third, scan all devices used to access the domain for malware, focusing on credential stealers and keyloggers. Organizations should add the domain and associated IP address 91.215.85.148 to network blocklists to prevent access from corporate environments. Monitor for signs of compromised credentials across other financial and cryptocurrency platforms, as attackers frequently test stolen credentials against multiple services.