IOK Rules: target.coinbase

Coinbase Phishing Kit cf711368

Detects a cloned version of the Coinbase website from the past that uses the same `amplitude.js` API key as well as the same Google Site Verification keys, they used to use.

Coinbase Phishing Kit 5d238ea1

A Coinbase Phishing Kit that has a hCaptcha verification screen to avoid analysis. This looks for the site key that is common across multiple examples.

Coinbase Phishing zG3nVT0g

Detects Coinbase recovery phrase scam websites. Often hosted on Glitch (https://glitch.com/).