SafeMode - Analysis: www.coinbase-wallet.org.cn

Visual Capture

Screenshot of www.coinbase-wallet.org.cn

Detection Info

https://www.coinbase-wallet.org.cn/coinbase/

Detected Brand

Coinbase

Country

Unknown

Confidence

95%

HTTP Status

200

Report ID

01f85527-9c8…

Analyzed

2026-06-27 22:09

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T11431E4368144B9973291D7C86F73AA75DAA06C81BDF2258040D8C7ED1A85F26FC53A08
CONTENT ssdeep	24:haWDauGhQHjELCaARjuLCaA6iuLlEdHjP6M7yfuCGFekHck7ckCBMbd:RAhciCa0jUCaHFLlEP3GfuCSZHn7nCBQ

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	e4669b393cc36436
VISUAL aHash	fffff3d383c3ffff
VISUAL dHash	3065252725258024
VISUAL wHash	909001018181ffff
VISUAL colorHash	070010001c0
VISUAL cropResistant	3065252725258024,0bc5550707070f2b

Code Analysis

Risk Score 50/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

📊 Risk Score Breakdown

Total Risk Score

70/100

Contributing Factors

Active Phishing Kit

Detected kit types: Credential Harvester

🔬 Comprehensive Threat Analysis

Threat Type

Credential Harvesting Kit

Target

Coinbase users

Attack Method

Phishing webpage

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester

🏢 Brand Impersonation Analysis

Impersonated Brand

Coinbase

Official Website

https://www.coinbase.com

Fake Service

Credential harvesting service

⚔️ Attack Methodology

Primary Method: Credential Harvesting

Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.

Secondary Method: Standard Phishing Techniques

Uses typical phishing tactics including brand impersonation, urgency tactics, and social engineering to trick victims into providing sensitive information.