update[.]www[.]nmlkwww[.]fupdate[.]banetnetcoinbase-withdraw-verifications[.]netflixconfirmation[.]net

This domain, update.www.nmlkwww.fupdate.banetnetcoinbase-withdraw-verifications.netflixconfirmation.net, is a brand impersonation threat specifically targeting Coinbase users. The domain was crafted to mimic Coinbase's withdrawal verification process, likely aiming to steal login credentials and drain cryptocurrency wallets. No drainer kit was identified, but the structure suggests a phishing page designed to capture sensitive information. The threat level is high due to the direct impersonation of a major cryptocurrency exchange.

Technical indicators reveal a strong malicious profile. VirusTotal shows 13 out of 95 security vendors flagging this domain, indicating broad detection across the security community. It appears on three separate blocklists, and the domain was registered through NameCheap, Inc., a common registrar for phishing domains. The domain resolves to IP address 188.166.152.221 and was created on February 21, 2026. No SSL certificate was present, which is unusual for legitimate Coinbase pages and serves as a red flag for users. Google Safe Browsing status was not provided, but the high detection rate suggests it would be flagged.

Currently, the domain is offline, indicating that it has been taken down or is no longer resolving. This likely resulted from reports to the registrar or hosting provider. However, the remaining risk is that the threat actor may register similar domains or reuse the infrastructure. Users should remain vigilant and verify any Coinbase-related communications through official channels. PhishDestroy recommends checking domain reputation before interacting with any suspicious URLs and enabling two-factor authentication on all cryptocurrency accounts.