coinbase[.]kred

This domain, coinbase.kred, is flagged as an active brand impersonation threat targeting Coinbase users. The site presents itself as a verification portal, a common tactic used to harvest login credentials, personal information, or deploy crypto-draining malware. Victims may be lured into entering sensitive details under the false pretense of account verification, which attackers then exploit for unauthorized access or financial theft. The risk is elevated due to the domain's convincing mimicry of the legitimate Coinbase brand and its use of a seemingly official SSL certificate to appear trustworthy.

Analysis indicates this domain was registered on July 02, 2026, through Dynadot Inc, a registrar frequently abused for malicious infrastructure. As of the latest scan, only 1 out of 95 security vendors on VirusTotal flagged the domain, suggesting it may evade detection by some security tools. The site resolves to the IP address 66.92.21.54 and uses a Let's Encrypt SSL certificate, which, while encrypting traffic, does not validate the legitimacy of the site. The page title 'Verification' further aligns with phishing campaigns designed to create urgency and prompt immediate user action.

If you visited coinbase.kred or entered any information on the site, take immediate steps to secure your accounts. First, disconnect any connected devices from the internet to prevent potential malware execution. Change the passwords for your Coinbase account and any other services where the same credentials may have been reused. Enable multi-factor authentication (MFA) if not already active. Monitor your accounts for unauthorized transactions or suspicious activity, and report any anomalies to the legitimate platform. Consider scanning your device for malware using updated security tools, as phishing sites often deploy additional payloads. Finally, report the domain to relevant abuse channels, including the registrar (Dynadot Inc) and security databases, to aid in takedown efforts.