conbasewallet[.]us

This domain, conbasewallet.us, is flagged as a high-risk crypto drainer threat currently active as of July 26, 2026. Analysis of observable evidence reveals several concrete indicators of malicious intent. The domain was created on July 22, 2026, only four days prior to the report date, which is a common pattern for short-lived phishing infrastructure. Registration is through ENOM, INC., and the domain resolves to IP address 142.11.217.123, hosted on nameservers ns55.hostwindsdns.com and ns56.hostwindsdns.com.

The page title is 'Coinbase Wallet - Download Your Coinbase Wallet', which directly impersonates a legitimate cryptocurrency wallet service to deceive users into downloading a malicious application or connecting their wallet, leading to asset theft. VirusTotal analysis shows 4 of 91 security vendors flagging this domain, indicating detection by multiple engines but not universal coverage. Google Safe Browsing flags the domain for social engineering, confirming it is designed to trick users. The domain appears on three security blocklists and is specifically blocked by PhishDestroy, MetaMask, and SEAL, reflecting its identification by industry threat intelligence platforms.

The domain's status remains active, meaning the phishing infrastructure is still operational and could be harvesting credentials or draining cryptocurrency wallets from unsuspecting visitors. The exact content of the website beyond the page title has not been analyzed, but the combination of a recently registered domain, a brand-impersonating title, security vendor flags, blocklist appearances, and Safe Browsing warnings provides strong evidence that this domain is part of an active crypto drainer campaign. Defenders should immediately block access to this domain and its IP address at network and email gateways, monitor for any associated subdomains or related infrastructure, and report the domain to hosting provider Hostwinds for abuse.