Looks to me more like a malware that changes the address in the web page you used at Coinbase. That particular wallet address shows up on the internet in the strangest places:
Alameda County Foreclosure listings:
https://www.propertyshark.com/mason/CA/Alameda-County/Trustees-Sales
Some random Wordpress blog:
https://supportantivirusblog.wordpress.com/2017/05/26/13aqmiworwr6grdfzswq1tdxdn9qkhwapd/
Here's a post on a different forum talking about a similar situation involving the exact same wallet:
https://steemit.com/bitcoin/@anubhav/bitcoin-virus-bug-hack-worm-steemitians-you-are-been-warned