beta[.]loginsecurecoinbaseid[.]com

This domain, beta.loginsecurecoinbaseid.com, is actively impersonating Coinbase to harvest user credentials through a fraudulent login portal. Analysis indicates the site mimics the legitimate Coinbase authentication interface, likely designed to trick victims into entering account details, which could lead to unauthorized access, cryptocurrency theft, or further exploitation via social engineering. The page title, loginsecurecoinbaseid.com, reinforces the deception by closely resembling the legitimate Coinbase domain structure, increasing the likelihood of user confusion during phishing campaigns.

Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on November 28, 2024, through Hosting Concepts B.V. d/b/a Registrar.eu, a registrar frequently associated with phishing infrastructure. It resolves to IP address 15.197.130.221, hosted on Amazon.com, Inc. (AS16509) in the United States, and is currently flagged by 11 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (R12), provides minimal assurance, as it is commonly exploited by threat actors to lend superficial legitimacy to malicious sites.

Users who have visited beta.loginsecurecoinbaseid.com or entered credentials on the site should take immediate action to mitigate risk. First, revoke any active sessions on the legitimate Coinbase platform and reset account passwords using a secure device. Enable multi-factor authentication (MFA) if not already active, and monitor the account for unauthorized transactions or configuration changes. If cryptocurrency transactions were initiated or wallet details were provided, consider transferring assets to a new wallet and reporting the incident to the platform’s support team. Additionally, scan the device used to access the site for malware, as credential harvesters often deploy secondary payloads to maintain persistence.