marketfinance[.]cyou

This domain, marketfinance.cyou, poses a significant threat as a brand impersonation site targeting Coinbase, a well-known cryptocurrency exchange platform. The site was designed to deceive users into believing they were interacting with a legitimate Coinbase service, potentially leading to the theft of sensitive information such as login credentials and personal data.

Analysis indicates that the domain has been flagged by 16 out of 95 security vendors on VirusTotal, highlighting the extent of its malicious nature. The domain was registered through Gname.com Pte. Ltd. on December 14, 2025. Infrastructure analysis reveals that it resolved to the IP address 172.67.202.150, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain did not possess an SSL certificate, further indicating a lack of security and authenticity. Additionally, the site has been added to one security blocklist, specifically PhishDestroy, and Google Safe Browsing has flagged it as a phishing site. These factors collectively contribute to the high risk level associated with marketfinance.cyou.

Users who visited marketfinance.cyou are advised to immediately change their Coinbase login credentials and monitor their accounts for any unauthorized activity. It is also recommended to run a full system scan using reputable antivirus software to detect and remove any potential malware that may have been installed. Users should remain vigilant and avoid clicking on suspicious links or entering personal information on unverified websites.