coinbasewithdrwal[.]net

PhishDestroy identifies coinbasewithdrwal.net as an active brand impersonation domain targeting Coinbase users. This deceptive domain mimics Coinbase’s withdrawal process to trick users into revealing login credentials or transferring funds. The site employs classic phishing tactics, including a slightly altered domain name to bypass initial scrutiny. No drainer kit signatures were detected in initial scans, suggesting a lightweight phishing page focused on credential harvesting. This domain resolves to IP address 34.111.179.208 and was registered on April 08, 2026 through Name.com, Inc. using a Let's Encrypt SSL certificate for added legitimacy. VirusTotal currently shows 1/95 detections, indicating it has not yet been widely flagged by security vendors. Google Safe Browsing (GSB) status remains unlisted, and the domain has not appeared on major blocklists at the time of analysis. The domain remains active and under investigation as of this assessment. Immediate actions include monitoring for malicious payload changes and updating network defenses to block the IP and domain. While current risk is classified as 'under_investigation', the lack of detections and recent registration date suggest this threat could escalate quickly. Users are strongly advised to verify all withdrawal URLs and avoid clicking suspicious links. Proactive blocking of 34.111.179.208 is recommended to prevent access.