sunny90-coinbase-supporter[.]hf[.]space

The domain sunny90-coinbase-supporter.hf.space is a phishing site engaged in brand impersonation, specifically targeting Coinbase users. It presents itself as an official financial management platform but is designed to harvest login credentials through cryptocurrency-related scams. No drainer kit was identified, and the site is currently taken offline, though it previously posed an elevated risk to victims.

Technical indicators confirm the malicious nature of sunny90-coinbase-supporter.hf.space. The domain was flagged by 1 of 95 VirusTotal security vendors, including LevelBlue, and appears on 1 security blocklist (PhishDestroy). It was registered through OVH sas on November 01, 2021, and resolves to the IP address 99.80.68.161, hosted on AWS EC2 in Ireland. The SSL certificate is issued by Amazon (Amazon RSA 2048 M01), and the observed page title was 'Login - Official verified financial Management'. Technologies detected include Node.js and Express, and the domain uses AWS nameservers.

Victims of sunny90-coinbase-supporter.hf.space should immediately change their Coinbase passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious transactions and report any fraud to Coinbase support. To report the phishing domain, submit it to Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group. If cryptocurrency was involved, review wallet activity for unauthorized transfers, though no drainer kit was detected in this case.