coinbase[.]secure-invoice[.]it[.]com

The domain coinbase.secure-invoice.it.com is a phishing site engaged in brand impersonation targeting Coinbase users. It poses an elevated risk by mimicking the cryptocurrency exchange to deceive victims into disclosing login credentials or sensitive financial information. No cryptocurrency drainer kit was identified. The site is currently taken offline, but prior activity classified it as a cryptocurrency scam.

Technical indicators confirm the malicious nature of coinbase.secure-invoice.it.com. VirusTotal reports 1 of 95 security vendors flagged the domain, while Google Safe Browsing has not yet marked it. The domain appears on 1 security blocklist, specifically PhishDestroy. Registered through Intis Telecom LTD on October 23, 1992, it resolves to the IP address 172.67.199.206, hosted on Cloudflare's infrastructure (AS13335) in the US. No SSL certificate is present, and the observed page title was 'Secure Receipt Access'. Nameservers are ns1.it.com, ns2.it.com, and ns3.it.com. Gridinsoft assigned a trust score of 0/100.

Victims of coinbase.secure-invoice.it.com should immediately change their Coinbase passwords and enable two-factor authentication if credentials were entered. Monitor accounts for unauthorized transactions and report any fraudulent activity to Coinbase support. The domain can be reported to Google Safe Browsing, PhishTank, or the registrar Intis Telecom LTD for further action. If cryptocurrency was involved, revoke any suspicious token approvals and consider transferring funds to a new wallet as a precaution.