coinbasessuport[.]cfd

The domain coinbasessuport.cfd has been identified as a brand impersonation site specifically targeting Coinbase users. This threat is classified as a phishing campaign that attempts to deceive victims into believing they are interacting with legitimate Coinbase support infrastructure. No crypto drainer kit was detected on the page, but the site's title "Index of /" suggests a directory listing that could have been used to host malicious files or redirect users to credential harvesting forms.

Technical analysis reveals that the domain was registered through Dynadot LLC on February 21, 2026, and resolves to IP address 72.11.147.244. VirusTotal flagged the domain with 8 out of 95 security vendors marking it as malicious, and it appears on three security blocklists. The site lacks an SSL certificate, which is a common red flag for phishing sites. Google Safe Browsing status was not provided, but the domain's presence on multiple blocklists indicates active monitoring by security communities.

As of the latest check, the domain is offline, suggesting that either the hosting provider or registrar has taken action in response to reports. However, the domain remains a risk because it could be reactivated or used for future campaigns. Users who may have visited the site should monitor their Coinbase accounts for unauthorized activity and enable two-factor authentication. PhishDestroy recommends avoiding any unsolicited communications claiming to be from Coinbase and always verifying URLs before entering credentials.