title: coinbase-page-title
description: |
  Sites with the same page title as Coinbase but not hosted on coinbase.com
level: potentially_malicious

detection:
  coinbaseTitle:
    title:
      - "Coinbase – Buy & Sell Bitcoin, Ethereum, and more with trust"
      - "Coinbase - Sign In"
  realDomain:
    hostname:
      - coinbase.com

  condition: coinbaseTitle and not realDomain

Rule matches