verify-wallet-coinbase[.]com

Analysis of verify-wallet-coinbase.com shows a domain created on July 26, 2025 and actively used in a crypto‑drainer campaign. The domain is registered through Tucows Domains Inc. and resolves to the IPv4 address 52.223.13.41. It has been added to a single security blocklist and is currently blocked by the PhishDestroy service.

VirusTotal records indicate that the domain was scanned by 91 antivirus and URL‑reputation vendors, none of which reported a detection at the time of the scan. The limited blocklist presence suggests that the infrastructure is relatively new or lightly tracked, yet the association with a known crypto‑drainer operation elevates its threat profile. Defenders should treat the domain as malicious despite the lack of vendor detections, enforce network‑level blocking of the resolved IP address, and add the domain to internal URL filtering policies.

Continuous monitoring of the IP owner and any future changes to the domain’s registration details is advised, as well as periodic re‑scanning with multiple threat‑intelligence platforms to capture any emerging indicators. Because the domain is still under investigation, additional telemetry such as TLS certificate details, HTTP response codes, and page content should be collected if possible to enrich the evidence base and support attribution efforts.