coinbase-securedwithdrawal-fthzzbzyg7[.]edgeone[.]app

coinbase-securedwithdrawal-fthzzbzyg7.edgeone.app is a cryptocurrency drainer domain impersonating the Coinbase brand. The page is designed to trick users into connecting wallets and signing malicious transactions that drain assets. No fake login form is present; instead, it leverages a Web3 crypto-drainer kit to execute unauthorized token transfers once a wallet is connected.

PhishDestroy identifies this domain with the following technical indicators: VirusTotal detection ratio is 6 out of 95 security vendors at time of analysis, the IP address is 43.152.26.58, the SSL certificate is issued by DigiCert, Inc., the domain resolves on the EdgeOne CDN, and it has been flagged on two external blocklists including SEAL and MetaMask. Creation details remain unverified due to CDN-based resolution obscuring WHOIS data. Google Safe Browsing (GSB) status is currently listed as unsafe.

This domain is currently active and poses an elevated risk to cryptocurrency users. It has been blocked by SEAL and MetaMask, indicating recognition across multiple security platforms. Users are strongly advised to avoid interacting with this domain and to verify any similar links using PhishDestroy. While current defenses have limited its reach, the presence of a crypto drainer kit and partial detection coverage suggests ongoing risk. Remaining exposure includes users who bypass browser warnings or access the link via unprotected networks. Immediate user caution and platform-level blocking remain essential to mitigate further compromise.