coinbase-walet[.]me

This domain, coinbase-walet.me, operates as a fraudulent impersonation of the legitimate Coinbase cryptocurrency platform, designed to deceive users into disclosing sensitive credentials or transferring digital assets to attacker-controlled wallets. Analysis indicates the site employs a near-identical visual and structural layout to the authentic Coinbase interface, including replicated login portals, wallet management dashboards, and transaction confirmation prompts. The primary objective appears to be credential harvesting or direct cryptocurrency theft, likely through fake wallet synchronization or malicious smart contract interactions, a tactic commonly associated with crypto drainer schemes. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through an obscure registrar, a common pattern among threat actors seeking to evade detection. VirusTotal detection metrics show 21 out of 95 security vendors flagging the domain as malicious, with specific classifications including phishing, brand impersonation, and cryptocurrency fraud. Additionally, the domain appears on three independent security blocklists, including specialized crypto threat intelligence feeds, and is actively blocked by enterprise-grade web filtering systems. Google Safe Browsing further corroborates these findings, explicitly labeling the domain as a phishing threat. Users who have interacted with coinbase-walet.me should immediately cease all engagement and take corrective measures to mitigate potential compromise. This includes revoking any connected wallet permissions, resetting passwords for associated accounts, and monitoring transaction histories for unauthorized activity. If cryptocurrency was transferred to addresses provided by the site, victims should report the incident to relevant blockchain analysis platforms and law enforcement cybercrime units. Proactive steps such as enabling multi-factor authentication and reviewing connected application permissions on legitimate platforms are strongly advised to prevent further exploitation. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts targeting Coinbase or other cryptocurrency services.