coinbasewithdrwal[.]com

coinbasewithdrwal.com — Brand Impersonation Investigation

coinbasewithdrwal.com has been identified as an active domain engaged in brand impersonation against Coinbase. The domain is currently under investigation following evidence of malicious intent, including the deliberate misspelling of a well-known cryptocurrency platform to deceive users. This constitutes a targeted threat aimed at exploiting trust in the Coinbase brand.

Technical analysis reveals the domain is registered through Name.com, Inc., resolving to IP 34.111.179.208 and secured with a Let's Encrypt SSL certificate. Notably, the domain was created on April 03, 2026, and remains undetected by VirusTotal’s vendor engines, with a current detection rate of 17 out of 95. While no blocklist entries are recorded yet, the absence of detections suggests early-stage deployment or sophisticated evasion tactics. The domain was registered just days ago, which may correlate with a recent campaign surge.

Assessment indicates a developing threat with high-risk potential due to the active status and low detection footprint. Immediate organizational action is required: block the IP 34.111.179.208 and domain coinbasewithdrwal.com at the network perimeter. Users should be warned to verify URLs before entering credentials or payment details, and DNS sinkholing should be considered for proactive mitigation. Monitor for associated malware or credential harvesting artifacts.