After the fall of FTX and the Ripple lawsuit in 2022, the U.S. Securities and Exchange Commission (SEC) is now looking into Wall Street corporations that may be violating custody regulations. (Read More)
Tl;dr:Search engine phishing exploits the trust we have in search engines and the convenience of searching for something rather than remembering the domain. The following piece outlines what search engine phishing attacks may look like and how Coinbase users can avoid them.
By Coinbase Security Team
How do you log in to Coinbase? If you’re like many people, you open your preferred browser and type “Coinbase” or “Coinbase login” in the address bar. You expect to get results like this:
But sometimes you may get results like this:
The second set of screenshots show an example of phishing links. This is called search engine phishing and it has become a trend for attackers targeting Coinbase accounts.
When most people think of phishing, email or SMS phishing comes to mind. However, phishing can take many forms. Search engine phishing exploits the trust we have in search engines and the convenience of searching for something rather than remembering the domain.
We all do it, but this opens us up to potential search engine phishing attacks if we are not diligent about checking our links and protecting ourselves online. Here are some tips to prevent this from happening to you:
Double-check our naming conventions
Coinbase uses a uniform naming convention for our websites and pages. The convention follows this pattern: [page].coinbase.com. For example, here are some of our pages:
One way to avoid this type of scam is to bookmark the above Coinbase pages that you frequent. Bookmarking removes the need to search for, or manually type, a domain name. Here is a quick tutorial on how to create bookmarks in the most popular browsers.
Know common scam naming conventions
It takes a good amount of work for anyone to get their website ranked high in search engine results. This is called Search Engine Optimization (SEO), which is the process of improving the traffic from search engines to a website. Some website services, including Google Sites and Microsoft Azure, offer built-in SEO functionality.
As seen in the screenshots above, attackers tend to exploit website services like Google Sites and Microsoft Azure — building a false sense of trust in the phishing link.. The naming conventions might follow a pattern like one of the following:
These phishing websites will typically then redirect to another phishing page after a victim clicks a button on the site. The redirect will take the victim to a second phishing page where the actual phishing attack happens. Using a second phishing site is a way for attackers to protect the first phishing site and maintain its SEO ranking. So, be aware of redirects as an indication that you may be visiting a phishing website. A typical flow may look like this:
Look for these red flags
Here are some indicators you can look for to protect yourself from search engine phishing:
Does the naming convention of the search result follow this pattern: [page].coinbase.com? If not, it is likely a phishing page.
When you click on a search result, are you redirected to a website with a different domain than what you expected? If so, it is likely a phishing page.
When you click on a search result, does the website look different than the last time you logged in to Coinbase? If so, this could be a phishing page which is using an older version of our website theme.
When you visit the website from the search results and click on a button, are you redirected to a website with a different domain than the first page? If so, it is likely a phishing page.
After you enter your credentials, are you prompted to call Coinbase because of some sort of error? Does a live chat box automatically open? This tactic is commonly paired with phishing attacks and is known as a “support scam” attack.
Here is an example of what a scam error may look like and a live chat box which may follow the error:
Remember, think before you click! Our US support phone number is 1–888–908–7930 and you can find other ways to contact us at help.coinbase.com. If you are suspicious of activity on a “Coinbase” website, go to our Help page and initiate a conversation there with our Support team.
We are constantly monitoring the internet to identify phishing domains and take them down, but we need your help. Please help us by reporting any suspicious domains to email@example.com.
One of the most common requests we receive from customers is to be able to trade more assets on our platform. As we continue to add assets to our exchange and platforms we have decided that we will no longer post individual blog posts and will only use Twitter to announce new asset listings.
Please make sure to follow @CoinbaseAssets for new asset announcements for Coinbase.com, iOS and Android apps, as well as Advanced Trading, Coinbase Pro, Coinbase Prime, Coinbase Custody and any new geo-fencing restrictions that may be lifted.
Please also make sure to follow @CoinbaseExch for new asset announcements for Coinbase Exchange and to be alerted as order books will launch in phases, auction mode then limit-only or full trading mode. If at any point one of the new order books does not meet our assessment for a healthy and orderly market, we may keep the book in one state for a longer period of time or suspend trading as per our Trading Rules.
To see a list of supported assets on Coinbase check out our new Asset Directory.
Please note: Coinbase Ventures may be an investor in the crypto projects we offer, and additionally, Coinbase may hold such tokens on its balance sheet for operational purposes. A list of Coinbase Ventures investments is available at https://ventures.coinbase.com/. Coinbase intends to maintain its investment in these entities for the foreseeable future and maintains internal policies that address the timing of permissible disposition of any related digital assets, if applicable. All assets, regardless of whether Coinbase Ventures holds an investment or Coinbase holds for operational purposes, are subject to the same strict review guidelines and review process.
Crypto is a new type of asset. Besides potential day to day or hour to hour volatility, each crypto asset has unique features. Make sure you research and understand individual assets before you transact.