4823848-coinbase[.]com

This domain, 4823848-coinbase.com, is an active phishing infrastructure impersonating Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site operates as a crypto drainer, designed to siphon digital assets from victims under the guise of premium services, as suggested by the page title 'ONE Bot - Premium Services Showcase.' The threat type is classified as brand impersonation with a secondary focus on cryptocurrency theft, targeting users through deceptive interfaces mimicking legitimate Coinbase operations.

Infrastructure analysis reveals the domain was registered on November 20, 2025, through Hello Internet Corp and resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. Security telemetry shows the domain is flagged by Google Safe Browsing for phishing and appears on three blocklists. VirusTotal detection rates stand at 17 out of 95 security vendors, indicating moderate but growing awareness of the threat. Additional defensive measures, such as those implemented by MetaMask and SEAL, have already blocked access to this infrastructure.

As of the latest assessment, the domain remains active and poses a high risk to users. Immediate response actions include continued monitoring, expansion of blocklist coverage, and public disclosure to prevent further victimization. Despite existing mitigations, the domain's persistence and use of Cloudflare hosting complicate takedown efforts. Users are advised to verify domain authenticity before interacting with any cryptocurrency-related services and to employ wallet security measures, such as hardware wallets or transaction previews, to mitigate the risk of asset loss.