IOK Rules: target.coinbase

Coinbase Phishing Kit 5d238ea1

A Coinbase Phishing Kit that has a hCaptcha verification screen to avoid analysis. This looks for the site key that is common across multiple examples.

Coinbase Phishing Kit cf711368

Detects a cloned version of the Coinbase website from the past that uses the same `amplitude.js` API key as well as the same Google Site Verification keys, they used to use.

Coinbase Phishing zG3nVT0g

Detects Coinbase recovery phrase scam websites. Often hosted on Glitch (https://glitch.com/).