wvw-coinoase[.]pro

PhishDestroy identifies wvw-coinoase.pro as a recently activated crypto drainer posing as a Coinbase login portal. The domain employs a generic phishing kit designed to harvest wallet credentials and initiate unauthorized transfers, leveraging urgency and social engineering to trick users into disclosing sensitive information. Based on telemetry and behavioral analysis, this campaign targets cryptocurrency holders under the guise of a legitimate exchange interface, with infrastructure optimized for rapid deployment and low detection latency.

This domain presents several distinct technical indicators of malicious intent. VirusTotal analysis shows zero detections out of 95 security engines as of the latest scan, indicating evasion of signature-based detection. The domain was registered on March 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar with a mixed reputation, and resolves to IP address 172.67.188.19, a known cloud hosting provider. The SSL certificate, issued by Let's Encrypt, appears valid but is commonly abused in phishing campaigns due to automated issuance and low validation barriers. The domain has not yet been flagged on Google Safe Browsing (GSB) and remains unlisted on major threat intelligence blocklists, increasing the risk of initial compromise.

As of this advisory, wvw-coinoase.pro remains active and under active monitoring by PhishDestroy’s threat intelligence team. The domain has not been sinkholed or blocked at the network level, and no takedown action has been initiated by hosting providers or law enforcement. Given the absence of detections, the recent registration date, and the use of a fresh SSL certificate, the risk of exposure to end users remains elevated. Immediate verification using PhishDestroy’s real-time domain lookup tool is strongly recommended before interacting with any links or forms on this domain. Users are advised to avoid entering credentials or wallet information and report any suspicious activity to their security teams or through PhishDestroy’s reporting portal.