Looks to me more like a malware that changes the address in the web page you used at Coinbase. That particular wallet address shows up on the internet in the strangest places:

Alameda County Foreclosure listings:

https://www.propertyshark.com/mason/CA/Alameda-County/Trustees-Sales

Some random Wordpress blog:

https://supportantivirusblog.wordpress.com/2017/05/26/13aqmiworwr6grdfzswq1tdxdn9qkhwapd/

Here's a post on a different forum talking about a similar situation involving the exact same wallet:

https://steemit.com/bitcoin/@anubhav/bitcoin-virus-bug-hack-worm-steemitians-you-are-been-warned