webmail[.]283776coinbase[.]com

PhishDestroy identified the domain webmail.283776coinbase.com as a high-risk brand impersonation threat targeting Coinbase. This domain was designed to deceive users into believing they were accessing legitimate Coinbase services, likely to steal login credentials or other sensitive financial information. No drainer kit was associated with this domain, but the impersonation of a major cryptocurrency exchange significantly elevates the danger to unsuspecting users.

Technical analysis reveals that the domain resolved to IP address 20.169.249.163, was registered through Sav.com, LLC, and was created on March 26, 2026. VirusTotal flagged this domain with a score of 15 out of 95 security vendors marking it as malicious. Google Safe Browsing categorizes the domain as phishing, and it appears on one security blocklist. The SSL certificate was issued by Let's Encrypt (R13), which is common for both legitimate and malicious sites, further complicating detection.

The domain is currently offline, meaning it has been taken down after detection. However, the low blocklist count of one suggests that this threat may have evaded broader security measures, and residual risk remains if similar domains become active. Users are advised to always verify URLs carefully and avoid clicking on links in unsolicited emails or messages. PhishDestroy recommends reporting any suspicious domains to the targeted brand and the appropriate authorities to prevent future attacks.