coinbase[.]aw-windblocker[.]com

PhishDestroy identifies coinbase.aw-windblocker.com as an active brand impersonation domain targeting Coinbase users. This domain, registered on September 20, 2025, resolves to IP 154.89.71.221 and is currently under investigation for its role in potential credential theft and crypto drainer campaigns. The domain employs a Let's Encrypt SSL certificate to enhance legitimacy, while its naming structure—embedding 'coinbase' within a subdomain of 'aw-windblocker.com'—suggests deliberate deception to lure unsuspecting users into entering sensitive login or payment information. No known drainer kit has been publicly linked to this domain yet, but its infrastructure and timing align with common phishing tactics observed in crypto-related fraud. This domain was flagged with 14/95 detections on VirusTotal as of the latest scan, indicating it has not yet been widely recognized by security vendors. It was registered through Cloud Yuqu LLC, a registrar known for hosting both legitimate and malicious domains, and its recent creation date (September 20, 2025) suggests a short operational lifespan intended to evade prolonged scrutiny. The domain does not appear on Google Safe Browsing (GSB) blocklists at this time, and no blocklist counts are available in public threat intelligence feeds. Its SSL certificate, issued by Let's Encrypt, adds a layer of perceived authenticity, which is a common tactic to bypass browser-based security warnings. As of now, the status of this domain remains active, with PhishDestroy continuing to monitor its behavior for signs of crypto drainer deployment or credential harvesting. Users and organizations are advised to block access to 154.89.71.221 and the domain coinbase.aw-windblocker.com at the network level, while reporting the domain to their security teams or threat intelligence platforms. The remaining risk is moderate due to its low detection rate and recent emergence, but the potential for rapid escalation into a full-scale phishing or crypto drainer campaign is high. Proactive blocking and user education on verifying domain legitimacy—especially for financial platforms like Coinbase—are critical to mitigating exposure.