coinbase-usercare[.]com

This domain, coinbase-usercare.com, is identified as a high-risk brand impersonation threat designed to deceive users into disclosing cryptocurrency wallet credentials or sensitive account information. Analysis indicates the site mimics Coinbase, a major cryptocurrency exchange, to exploit trust and facilitate unauthorized access to user funds. The infrastructure is engineered to appear legitimate, leveraging techniques such as reCAPTCHA and HTTP/3 to evade detection and enhance perceived authenticity. Infrastructure analysis reveals multiple red flags. The domain was registered on May 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious activity. Security vendors on VirusTotal flagged the domain at a rate of 16/95, indicating widespread recognition of its malicious intent. Additionally, the domain appears on three security blocklists and resolves to the IP address 107.182.130.90. The page title, set to https://www.google.com/, further suggests an attempt to obfuscate its true purpose and mislead users or automated detection systems. Users who visited coinbase-usercare.com should take immediate action to mitigate potential risks. First, revoke any permissions granted to unknown applications or browser extensions linked to the domain. Second, reset passwords for Coinbase and any other cryptocurrency-related accounts, ensuring the use of unique, complex credentials. Third, monitor accounts for unauthorized transactions and enable multi-factor authentication where available. If financial loss is suspected, report the incident to relevant authorities and consider freezing affected assets to prevent further exploitation.