coinbasexnfts[.]com

This domain is flagged as a high-risk crypto drainer infrastructure impersonating Coinbase, a major cryptocurrency exchange platform. The threat type involves brand impersonation designed to deceive users into connecting wallets, leading to unauthorized fund transfers through malicious smart contracts or verification prompts. Analysis indicates the domain is engineered to exploit trust in the Coinbase brand, particularly targeting users engaging with non-fungible tokens (NFTs) or wallet verification processes. Infrastructure analysis reveals the domain coinbasexnfts.com was registered on February 21, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious registrations. It resolves to the IP address 198.251.88.32, hosted on AS53667 FranTech Solutions, a provider commonly linked to bulletproof hosting environments. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user data. Security vendors on VirusTotal flagged the domain at a rate of 17/95, while it appears on three distinct security blocklists. Google Safe Browsing explicitly categorizes the domain as phishing, and it has been blocked by PhishDestroy, MetaMask, and SEAL. The page title, 'Bot Verification,' suggests an attempt to mimic legitimate security checks while harvesting sensitive wallet credentials or executing unauthorized transactions. Mitigation against this crypto drainer threat requires heightened user awareness and technical controls. Users should verify domain authenticity by cross-referencing official Coinbase communications and avoiding interaction with unofficial verification prompts. Wallet providers and exchanges are advised to integrate blocklist updates to prevent access to the domain and its associated IP address. Organizations should monitor for DNS resolutions to 198.251.88.32 and enforce strict SSL certificate validation to detect man-in-the-middle attacks. Given the domain's offline status, continuous monitoring for re-emergence under similar naming conventions or infrastructure is recommended, as threat actors often reuse hosting providers and registration patterns.