305828coinbase.com

Findings

Each finding below is derived from a captured artifact. Expand one to see exactly what it was drawn from.

Analyst summary

Observed 3 capture stage(s); canonical stage is late_render_3s.
Content changed across stages: page title changed between stages; visible text changed materially; new forms appeared after initial capture.
Credential collection UI appeared late in the capture sequence.
POST targets observed during capture: https://305828coinbase.com/cdn-cgi/rum?.
Distinctive asset clues: v4513226cdae34746b4dedf0b4dfa099e1781791509496, Do5tsLBu.js, TmWS346J.css, css2.

Supported findings2

Brand impersonation of Coinbase
Brand Impersonation
305828coinbase.com is not the official Coinbase domain, while the captured page presents Coinbase branding.
deterministic correlation
Brand Impersonation via Typosquat Domain
Brand Impersonation
Domain 305828coinbase.com is a typosquat of coinbase.com, presenting Coinbase branding and help content. Registered 6 days ago, consistent with disposable phishing domains.
ai interpretation

Capture signals

Forms: 1
Password fields: 0
Resources: 17
Distinct hosts: 4

Threat-KB / IOK matches0

Not evaluated

No known kit signatures matched this capture.