zoinbase[.]store

The domain zoinbase.store has been identified as a brand impersonation threat specifically targeting Coinbase, the well-known cryptocurrency exchange platform. This domain was created on February 21, 2026, and its page title is set to zoinbase.store, which closely mimics the legitimate Coinbase brand to deceive users into believing they are visiting an official site. Although no specific drainer kit has been confirmed in this instance, the domain's sole purpose appears to be phishing for sensitive information such as login credentials or cryptocurrency wallet details.

Technical indicators for this threat are significant and include a VirusTotal score of 6 out of 95 security vendors flagging the domain as malicious, indicating a moderate level of detection among security solutions. The domain was registered through Above.com Pty Ltd and resolves to IP address 199.59.243.228. Its SSL certificate was issued by Let's Encrypt (R13), which is commonly used by both legitimate and malicious sites. The domain appears on 1 security blocklist, and it is not currently listed on Google Safe Browsing (GSB) as a dangerous site, but this may change as more intelligence is gathered.

Currently, zoinbase.store is offline, meaning it has been taken down or is no longer resolving. This suggests that proactive response actions, such as reporting to the registrar or hosting provider, have been effective in mitigating immediate risk. However, users should remain vigilant as similar domains may appear under different names or TLDs. PhishDestroy recommends that Coinbase users always verify URLs carefully, enable two-factor authentication, and avoid clicking on unsolicited links. If any credentials were entered on this site, they should be changed immediately and accounts monitored for unauthorized activity.