update[.]www[.]onqponmlkupdate[.]cbanetnetcoinbase-withdraw-verifications[.]netflixconfirmation[.]net

This high-risk brand impersonation threat specifically targets Coinbase users. The domain, which masquerades as an official Coinbase verification page, was designed to steal login credentials and potentially cryptocurrency assets from unsuspecting victims. Its complex, deceptive URL structure mimics legitimate Coinbase subdomains to evade casual inspection.

Security analysis reveals severe indicators: VirusTotal flags this domain with 13 out of 95 security vendors marking it as malicious. The domain resolves to IP address 188.166.152.221 and appears on three separate security blocklists. Registered through NameCheap, Inc., the domain was created on February 21, 2026, and uses an SSL certificate from ZeroSSL (ZeroSSL ECC Domain Secure Site CA) to appear legitimate. Currently, the domain has been taken offline, but similar threats may arise.

Users who encounter this domain should never enter any personal or financial information. If credentials were already submitted, immediately change passwords on the official Coinbase website and enable two-factor authentication. Report any such domains to Coinbase's security team and consider monitoring accounts for unauthorized activity. Always verify URLs by manually typing the official Coinbase address rather than clicking links from emails or messages.