sso-web-coinnbes-cdnn[.]tem3[.]io

PhishDestroy identifies sso-web-coinnbes-cdnn.tem3.io as a high-risk crypto drainer impersonating Coinbase’s single sign-on (SSO) portal, actively deployed to steal cryptocurrency wallet credentials and assets. This domain is part of a sophisticated phishing campaign targeting users expecting secure access to Coinbase services via SSO workflows. The infrastructure is designed to deceive victims into entering wallet recovery phrases or connecting compromised applications, enabling direct asset exfiltration.

This domain was flagged by 19 of 95 VirusTotal security vendors, with additional detections from Google Safe Browsing under the SOCIAL_ENGINEERING category. The domain resolves to IP address 188.114.97.3, was registered on August 2, 2024 through GoDaddy.com, LLC, and holds an SSL certificate issued by Google Trust Services. It has been blocked by MetaMask and appears on one security blocklist. The domain’s recent creation, coupled with high detection rates and active blocking by a major crypto wallet provider, underscores its malicious intent and elevated threat level.

To mitigate risk, users should never enter credentials or connect wallets via unsolicited SSO prompts, especially those received via email or third-party links. Always navigate directly to official Coinbase domains (coinbase.com) and verify URLs before interaction. Enable multi-factor authentication (MFA) on all crypto accounts and use hardware wallets for large holdings. Report suspicious domains to security teams or platforms like PhishDestroy for rapid takedown and community protection.