purchs-allocation[.]xyz

PhishDestroy has identified purchs-allocation.xyz as a confirmed brand impersonation phishing site targeting Coinbase users. The domain, currently offline, posed as a fraudulent crypto distribution platform under the page title "$PURCH DISTRIBUTION," aiming to trick users into connecting their wallets or revealing sensitive information. This high-risk threat was designed to drain cryptocurrency assets from unsuspecting victims by mimicking the legitimate Coinbase brand.

Technical analysis reveals that purchs-allocation.xyz was created on February 21, 2026, and registered through NiceNIC International Group Co., Limited, a registrar often associated with malicious domains. It resolves to IP address 188.114.96.3, which is linked to Cloudflare infrastructure. VirusTotal flagged the domain with 11 out of 95 security vendors marking it as malicious, and it appears on four separate security blocklists. No SSL certificate was found, further indicating its fraudulent nature. These indicators collectively point to a carefully crafted phishing campaign designed to bypass casual scrutiny while exploiting the trust associated with the Coinbase name.

The domain has been taken offline, but users should remain vigilant. PhishDestroy recommends that anyone who may have interacted with purchs-allocation.xyz immediately revoke any wallet permissions granted and enable two-factor authentication on their Coinbase account. Always verify URLs directly through official Coinbase channels and avoid clicking on unsolicited links promising crypto distributions. For further protection, use PhishDestroy's browser extension to receive real-time warnings against such threats.