dech[.]pdd-yes[.]vip

The domain dech.pdd-yes.vip is a high-risk phishing site engaged in brand impersonation, specifically targeting Coinbase users. It presents itself as a cryptocurrency service under the guise of 'Coinbase OTC' to deceive victims into disclosing login credentials or sensitive information. No drainer kit was identified, but the site operates as a credential-harvesting scam. As of the latest verification, dech.pdd-yes.vip has been taken offline, though prior activity confirms its malicious intent.

Technical indicators confirm the threat posed by dech.pdd-yes.vip. The domain was flagged by 14 of 95 security vendors on VirusTotal, including ChainPatrol and BitDefender, and is listed on Google Safe Browsing for 'SOCIAL_ENGINEERING'. It appears on one security blocklist (PhishDestroy) and was registered through Gname.com Pte. Ltd. on August 29, 2025. The domain resolves to IP address 8.209.102.168, hosted on Alibaba (US) Technology Co., Ltd. infrastructure in Germany. No SSL certificate was issued, and the observed page title was 'Index - Coinbase OTC'. Nameservers for the domain are a2.share-dns.com and b2.share-dns.net.

Individuals who interacted with dech.pdd-yes.vip should immediately change any compromised credentials, particularly for Coinbase or other cryptocurrency accounts. Enable two-factor authentication (2FA) on all financial and crypto-related services to prevent unauthorized access. Monitor accounts for suspicious transactions and report any fraudulent activity to the affected platform. Victims may also report the phishing domain to Google Safe Browsing, their local cybercrime unit, or platforms like PhishTank to aid in broader takedown efforts.