coinbase[.]com-us-clickid-223jkjk[.]pw

The domain coinbase.com-us-clickid-223jkjk.pw poses a brand impersonation threat targeting Coinbase users. It is designed to trick individuals into believing they are interacting with the legitimate Coinbase platform, potentially leading to credential theft or unauthorized access to crypto assets. The domain likely hosts fake login pages or interfaces aiming to capture sensitive user information, thereby facilitating crypto draining or account takeover.

Technical analysis reveals this domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, with a creation date of April 10, 2026. Despite being relatively new, the domain has not yet been detected by any of the 95 engines on VirusTotal, scoring 11/95, indicating it is currently under the radar of many automated detection systems. It resolves to IP address 195.20.18.202 and uses a Let's Encrypt SSL certificate, which can lend it an appearance of legitimacy to unsuspecting users. At this time, the domain remains active and under investigation, with no blocklist count reported yet, emphasizing the need for vigilance.

Users who have visited coinbase.com-us-clickid-223jkjk.pw should exercise caution immediately. It is recommended to avoid entering any login credentials or personal information on this domain. If credentials were submitted, users should promptly change their Coinbase passwords and enable two-factor authentication. Monitoring for unauthorized transactions or suspicious account activity is critical. For safety confirmation and the latest updates, users are advised to verify this domain’s risk status on PhishDestroy, a trusted resource for tracking brand impersonation and phishing threats.