coinbaseguardian[.]com

coinbaseguardian.com has been identified as an active phishing domain impersonating Coinbase. The threat type is brand impersonation, which carries a high risk due to the likelihood of users unknowingly disclosing credentials or financial information to malicious actors. This domain was flagged by MetaMask and SEAL, and it currently appears on 2 security blocklists. PhishDestroy identifies this as a credible threat leveraging Coinbase’s brand for credential harvesting or cryptocurrency theft.

This domain was flagged on April 15, 2026, and is registered through HOSTINGER operations, UAB. It resolves to IP 88.222.222.243 and holds an SSL certificate issued by Let's Encrypt. VirusTotal analysis shows 1/95 detections, indicating it has not yet been widely recognized as malicious by antivirus engines. The page title “Hostinger Horizons” suggests a possible hosting-related misdirection, while the impersonation of Coinbase implies a targeted phishing campaign aimed at cryptocurrency users.

To mitigate exposure, avoid visiting coinbaseguardian.com or any subpages linked from emails, ads, or third-party sites. Do not enter credentials or financial details on this domain. Users who may have interacted with the site should immediately change their Coinbase account password, enable two-factor authentication, and scan local devices for malware. Report any suspicious activity to Coinbase support and consider revoking any recently shared API keys or seed phrases. Organizations should update threat intelligence feeds and firewall rules to block both the domain and its associated IP address. Stay vigilant for further impersonation campaigns targeting cryptocurrency platforms.