wallet[.]coinbase[.]fundanubio[.]org

The domain wallet.coinbase.fundanubio.org has been identified as a high-risk brand impersonation threat targeting Coinbase users. Currently offline, this deceptive domain was designed to trick visitors into believing they were accessing a legitimate Coinbase wallet service, thereby stealing login credentials and potentially cryptocurrency assets. PhishDestroy confirms this site is a confirmed phishing operation, not affiliated with Coinbase in any way.

Technical analysis reveals that the domain resolves to IP address 204.93.224.41 and was created on December 12, 2022, through registrar PDR Ltd. d/b/a PublicDomainRegistry.com. It is flagged by 12 out of 95 security vendors on VirusTotal, indicating widespread recognition of its malicious nature. Additionally, the domain appears on three separate security blocklists and uses an SSL certificate issued by Let's Encrypt (R13) to falsely appear legitimate. The page title observed was "Home - Fundación El Danubio," which is unrelated to Coinbase and further demonstrates the fraudulent intent.

As of now, the domain has been taken offline, but similar threats may emerge. Users who have interacted with this site should immediately change their Coinbase passwords and enable two-factor authentication. Always verify URLs directly through official Coinbase channels and avoid clicking links from unsolicited messages. PhishDestroy recommends using its verification tool to check any suspicious domains before engaging with them.