bids-sea[.]io

This domain, bids-sea.io, is identified as an active brand impersonation threat targeting Coinbase users. The site presents itself as a cryptocurrency or digital asset platform, as indicated by the page title 'Discover digital art and collection,' but analysis confirms it is designed to deceive users into disclosing sensitive credentials or financial information under false pretenses. Infrastructure analysis reveals the domain was registered on December 07, 2023, through NameSilo, LLC, and currently resolves to the IP address 192.3.207.218, hosted on AS36352 (HostPapa) in the United States. The domain appears on one security blocklist and is flagged by 5 of 95 security vendors on VirusTotal. It uses a Let's Encrypt SSL certificate (R12), which, while providing encryption, does not validate the legitimacy of the site. The combination of recent registration, brand impersonation, and low detection rates suggests an attempt to evade automated security filters. Current status remains active, posing a high risk to users. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to prevent access. Users who may have interacted with the site should immediately revoke any active sessions, reset credentials, and monitor accounts for unauthorized activity. Security teams should treat this domain as a confirmed phishing asset and include its indicators—domain, IP, and SSL fingerprint—in threat intelligence feeds for proactive defense.