us831649-coinbase[.]com

PhishDestroy identifies us831649-coinbase.com as an elevated risk domain engaged in brand impersonation, specifically targeting Coinbase users. This domain was designed to deceive visitors into believing they are on a legitimate Coinbase security checkpoint, as indicated by its page title, "Checking the security of your connection." Such tactics are commonly used in credential theft or crypto drainer campaigns to harvest sensitive information from unsuspecting victims.

This domain was registered on November 19, 2025, through NiceNIC International Group Co., Limited, a registrar often associated with malicious registrations. It resolves to IP address 104.21.47.252 and has been flagged by 15 out of 95 security vendors on VirusTotal, appearing on one security blocklist. Notably, the domain lacks an SSL certificate, which is a significant red flag for any site requesting sensitive information. The domain is currently offline, but similar threats may resurface under different names.

To protect against this specific threat, users should always verify the URL of any Coinbase-related site, ensuring it matches the official coinbase.com domain. Avoid clicking on links from unsolicited emails or messages, and enable two-factor authentication on all cryptocurrency accounts. If you have already interacted with this domain, change your passwords immediately and monitor your accounts for unauthorized activity. Report any suspicious domains to relevant security authorities.