ww25[.]authlink-coinbase[.]sweetorangewarung[.]com

The domain ww25.authlink-coinbase.sweetorangewarung.com is a phishing site engaged in brand impersonation targeting Coinbase users. It poses an elevated risk by mimicking the cryptocurrency exchange to deceive victims into disclosing login credentials or sensitive information, though no drainer kit was detected. The site is currently taken offline, reducing immediate exposure but leaving past victims at risk of fraud or account compromise.

Technical indicators confirm the domain's malicious intent. As of analysis, 2 of 95 VirusTotal security vendors flagged ww25.authlink-coinbase.sweetorangewarung.com, while it appears on 1 security blocklist (PhishDestroy). The domain was registered on November 01, 2024, through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and resolves to IP address 199.59.243.228, hosted on Amazon.com, Inc. infrastructure in the US. No SSL certificate was observed, and the page title displayed as 'sweetorangewarung.com'. The HTTP status returned a 429 error, and nameservers are 170.ns1.abovedomains.com and 170.ns2.abovedomains.com.

Victims of ww25.authlink-coinbase.sweetorangewarung.com should immediately change their Coinbase passwords and enable two-factor authentication if credentials were entered. Monitor accounts for unauthorized transactions or suspicious activity, and report the incident to Coinbase's official support channels. Additionally, victims may submit the domain to Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in broader takedown efforts. If financial loss occurred, contact law enforcement and provide all relevant details for investigation.