accounts[.]actual[.]oriole-94[.]lcl[.]dev

The phishing domain accounts.actual.oriole-94.lcl.dev, now offline, was actively targeting Coinbase users. Despite being taken down, it was detected during its active phase with zero hits on VirusTotal, highlighting its freshness. This domain exploited the typical 24-72 hour gap between registration and antivirus database updates, a period when such threats often operate undetected by traditional security measures.

The domain was registered through Squarespace Domains II LLC and hosted on a Cloudflare IP in the US. It impersonated Coinbase, a popular cryptocurrency platform, and also included references to Google on its pages. The page title, "My account | Madrona Demo," suggests an attempt to lure users into providing sensitive information under the guise of a legitimate service.

PhishDestroy identified this threat on December 24, 2025, and it was subsequently listed on public blocklists by PhishDestroy, MetaMask, and SEAL. The use of Google Trust Services for SSL certification might have lent an air of legitimacy to unsuspecting users. Although the domain is currently offline, its early detection underscores the importance of proactive threat intelligence in combating phishing attacks, particularly those targeting high-value platforms like Coinbase.