coinbasewallet[.]sbs

PhishDestroy identifies coinbasewallet.sbs as an active cryptocurrency wallet drainer impersonating the Coinbase brand. The domain leverages brand trust to trick users into connecting malicious wallets or entering seed phrases. Security research shows this infrastructure is designed to siphon digital assets under the guise of a legitimate Coinbase service. The domain coinbasewallet.sbs resolves to IP address 216.198.79.1 and operates under a Let’s Encrypt SSL certificate. It was registered on April 08, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal analysis reveals that 6 out of 95 security vendors flag this domain as malicious. Despite its recent creation, this domain has already been detected by Google Safe Browsing (GSB) and has appeared on multiple threat intelligence blocklists, indicating emergent but confirmed malicious activity. As of this report, coinbasewallet.sbs remains active and unblocked by many browsers and security tools. PhishDestroy continues to monitor this domain and has flagged it with an elevated risk level due to its impersonation of a major financial brand and potential to facilitate crypto theft. Users are strongly advised to avoid visiting this domain, verify any Coinbase-related links using official sources, and use PhishDestroy’s real-time scanning to detect similar threats. The risk remains elevated as the domain is likely part of a broader campaign targeting cryptocurrency users.