coinbase-check[.]netlify[.]app

This domain, coinbase-check.netlify.app, operates as a high-risk brand impersonation site targeting Coinbase users. The page presents itself as a legitimate Coinbase login portal under the title 'Account Access,' designed to harvest user credentials. Analysis indicates the site is explicitly crafted to deceive victims into entering sensitive account information, which can lead to unauthorized access, financial theft, or further exploitation of linked cryptocurrency wallets. The threat is particularly severe given Coinbase's role as a major cryptocurrency exchange, increasing the likelihood of targeted users possessing valuable digital assets.

Infrastructure analysis reveals the domain is hosted on Netlify's platform and resolves to the IP address 63.176.8.218. Despite its malicious intent, the domain is flagged by only 1 of 95 security vendors on VirusTotal, demonstrating limited detection coverage. The SSL certificate is issued by DigiCert Inc, providing a false sense of security to potential victims. No historical blocklist data or creation date was provided, but the domain remains actively serving malicious content as of this report. The use of Netlify's legitimate hosting service further complicates detection, as it blends with benign traffic patterns.

Users who have visited coinbase-check.netlify.app or entered credentials on this site should immediately revoke access to any linked accounts, enable multi-factor authentication, and monitor for unauthorized transactions. All potentially exposed passwords should be changed across any platforms where reuse occurred. Cryptocurrency wallet holders should transfer assets to new, secure wallets and review transaction histories for anomalies. Organizations should update blocklists to include this domain and its resolving IP, while security teams should investigate any internal access attempts to this infrastructure for signs of compromise.