coinbase-xqyu[.]discoverts[.]my

The domain coinbase-xqyu.discoverts.my is a confirmed phishing site engaged in brand impersonation targeting Coinbase users. It presents itself as the legitimate cryptocurrency exchange to deceive victims into disclosing login credentials or sensitive account details, posing an elevated risk of financial fraud. No cryptocurrency drainer kit was identified. The site is currently taken offline, but prior activity indicates it was actively used for cryptocurrency-related scams.

Technical indicators confirm the malicious nature of coinbase-xqyu.discoverts.my. As of analysis, 2 of 95 security vendors on VirusTotal flagged the domain, including SOCRadar and Trustwave. The domain was registered through NameCheap, Inc. on October 08, 2025, and resolves to the IP address 192.178.155.147, hosted on Google LLC's infrastructure (AS15169) in the US. It appears on one security blocklist, PhishDestroy, and has a Gridinsoft trust score of 0/100. No SSL certificate was observed, and the page title displayed 'Google'. Nameservers are olga.ns.cloudflare.com and peyton.ns.cloudflare.com.

Victims who interacted with coinbase-xqyu.discoverts.my should immediately change their Coinbase passwords and enable two-factor authentication (2FA) if not already active. Monitor accounts for unauthorized transactions or suspicious activity. If cryptocurrency transactions were attempted, review wallet approvals and consider transferring funds to a new wallet. Report the phishing domain to Coinbase's official abuse channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader takedown efforts.