files[.]coinbaseaba[.]com

PhishDestroy identifies files.coinbaseaba.com as an active brand impersonation threat using malicious domain tactics to deceive users into connecting crypto wallets or surrendering credentials under Coinbase's branding.

This domain represents an escalated risk due to its targeted impersonation of a major cryptocurrency exchange. Discovered on June 23, 2025, the domain resolves to IP address 45.192.170.205 and is registered via Dominet (HK) Limited. Security telemetry confirms 8 out of 95 VirusTotal scanners flagged it as malicious, and it has been listed on two security blocklists including detection by MetaMask and SEAL security systems. Trust scores and network analysis further validate its malicious intent.

To mitigate exposure, users must never click unverified links claiming to be from Coinbase, especially those promoting file downloads or wallet connections. Validate domains by manually typing the official URL and enabling wallet address scanning features in security extensions like MetaMask. If interaction occurs, revoke any unauthorized wallet connections immediately via your wallet’s connection manager and scan devices with updated antivirus software. Report suspicious activity to Coinbase Security and contribute to threat intelligence platforms such as URLScan or PhishTank.