795813coinbase[.]com

The domain 795813coinbase.com carries an elevated risk level as a confirmed brand impersonation site targeting Coinbase. This specific threat involves a fake login page designed to steal credentials from unsuspecting users who believe they are accessing a legitimate Coinbase platform. The site was taken offline after being discovered, but its prior existence posed a significant risk to cryptocurrency holders.

Technical analysis reveals several red flags. The domain was registered on October 11, 2025, through NiceNIC International Group Co., Limited, a registrar often associated with malicious domains. It resolves to IP address 104.21.49.128 and lacks an SSL certificate, making any data transmitted vulnerable to interception. VirusTotal data shows 13 out of 95 security vendors flagging this domain as malicious, and it appears on one security blocklist. These indicators collectively confirm the domain's malicious intent.

To protect against such threats, users should always verify URLs by typing the official Coinbase address directly into their browser rather than clicking links from emails or messages. Enable two-factor authentication on all crypto accounts and use a password manager to avoid entering credentials on lookalike sites. Report any suspicious domains to PhishDestroy and relevant authorities to help dismantle phishing networks. Stay vigilant—crypto drainers and fake login pages are increasingly sophisticated, but careful verification can prevent asset loss.