Security Public Service Announcement: Search Engine Phishing | by Coinbase

Tl;dr: Search engine phishing exploits the trust we have in search engines and the convenience of searching for something rather than remembering the domain. The following article describes what search engine phishing attacks can look like and how Coinbase users can avoid them.

By Coinbase Security Team

How do I login to Coinbase? If you’re like a lot of people, you open your favorite browser and type “Coinbase” or “Coinbase login” into the address bar. You expect to get results like this:

But sometimes you can get results like this:

The second set of screenshots shows an example of phishing links. This is called search engine phishing and has become a trend for attackers targeting Coinbase accounts.

When most people think of phishing, email or SMS phishing comes to mind. However, phishing can take many forms. Search engine phishing exploits the trust we have in search engines and the convenience of searching for something rather than remembering the domain.

We all do this, but it exposes us to potential search engine phishing attacks if we’re not diligent about verifying our links and protecting ourselves online. Here are some tips to prevent this from happening to you:

Coinbase uses a uniform naming convention for our websites and pages. The convention follows this pattern: [page].coinbase.com. For example, here are some of our pages:

One way to avoid this type of scam is to bookmark the above Coinbase pages that you frequent. Bookmarking eliminates the need to manually search or enter a domain name. Here is a quick Tutorial on how to create bookmarks in the most popular browsers.

It takes a lot of hard work for anyone to get their website ranked high in search engine results. This is called search engine optimization (SEO), which is the process of improving search engine traffic to a website. Some website services, including Google Sites and Microsoft Azure, offer built-in SEO functionality.

As seen in the screenshots above, attackers tend to exploit website services such as Google Sites and Microsoft Azure, creating a false sense of trust in the phishing link. Naming conventions can follow a pattern like one of the following:

sites.google.com/[phishingpage].com
[phishingpage].azurewebsites.net

These phishing websites will usually redirect to another phishing page after a victim clicks a button on the site. The redirect will take the victim to a second phishing page where the actual phishing attack occurs. Using a second phishing site is a way for attackers to protect the first phishing site and maintain its SEO ranking. So be aware of redirects as an indication that you may be visiting a phishing website. A typical flow might look like this:

Here are some indicators you can look for to protect yourself against search engine phishing:

Does the naming convention for the search result follow this pattern: [page].coinbase.com? If not, it’s probably a phishing page.
When you click on a search result, are you redirected to a website with a different domain than you expected? If so, it’s probably a phishing page.
When you click on a search result, is the website different from the last time you logged into Coinbase? If so, it may be a phishing page that is using an older version of our website theme.
When you visit the website from the search results and click a button, are you redirected to a website with a different domain than the one on the first page? If so, it’s probably a phishing page.
After entering your credentials, are you prompted to call Coinbase due to some kind of error? Does a live chat box open automatically? This tactic is commonly associated with phishing attacks and is known as a “support scam” attack.

Here is an example of what a scam error may look like and a live chat box that may follow the error:

Remember, think before you click! Our US support phone number is 1–888–908–7930 and you can find other ways to contact us at help.coinbase.com. If you suspect activity on a “Coinbase” website, head over to our help page and start a conversation with our support team there.

We constantly monitor the internet to identify phishing domains and remove them, but we need your help. Help us by reporting any suspicious domains to security@coinbase.com.