update[.]www[.]fupdate[.]banetnetcoinbase-withdraw-verifications[.]netflixconfirmation[.]net

PhishDestroy has identified a high-risk brand impersonation campaign targeting Coinbase users through the deceptive domain update.www.fupdate.banetnetcoinbase-withdraw-verifications.netflixconfirmation.net. This domain is currently offline but was actively designed to steal cryptocurrency credentials and drain wallets. The threat is classified as a crypto drainer, specifically impersonating the legitimate Coinbase brand to trick users into surrendering sensitive account information.

Technical analysis reveals that the domain was created on February 21, 2026, and resolved to IP address 188.166.152.221. It was registered through NameCheap, Inc., and secured with an SSL certificate from ZeroSSL. VirusTotal flagged the domain as malicious by 11 of 95 security vendors, and it appears on three security blocklists. The domain's convoluted structure, including terms like "withdraw" and "verifications," is indicative of a sophisticated phishing attempt aimed at harvesting login credentials and two-factor authentication codes.

Although the domain has been taken offline, the threat landscape remains volatile. Users who may have interacted with this domain are advised to immediately change their Coinbase passwords, enable hardware-based two-factor authentication, and monitor their accounts for unauthorized transactions. PhishDestroy recommends reporting any suspicious activity to Coinbase support and running a full security scan on affected devices. Continued vigilance against such crypto drainers is essential to protect digital assets.