coinbase002[.]xyz

This domain, coinbase002.xyz, is flagged as a brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site was designed to harvest user credentials through a deceptive login interface, presenting a page titled 'Redirecting...' to obscure malicious intent. No direct association with a known drainer kit is confirmed, but the infrastructure aligns with credential theft operations commonly used in cryptocurrency phishing campaigns. Infrastructure analysis reveals the domain was registered on July 30, 2025, through Dynadot LLC and resolves to the IP address 188.114.97.3. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious, while it appears on 4 security blocklists, including PhishDestroy, 1Hosts, PhishingDB, and 1HostsXtra. The domain holds a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, further corroborating its malicious classification. AlienVault OTX records the domain in 16 threat intelligence pulses, indicating active tracking by the security community. As of the latest assessment, coinbase002.xyz has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access to Coinbase accounts, reset credentials if exposure is suspected, and implement multi-factor authentication to mitigate potential account compromise. Continuous monitoring of related infrastructure is recommended, as threat actors may re-establish operations under similar domains.