nsdaiu3824nas[.]live

This domain, nsdaiu3824nas.live, was set up to trick Coinbase users into thinking they were accessing a legitimate support agent interface. The page title "Coinbase Support - Agent Panel" is a clear giveaway that scammers wanted visitors to believe they were interacting with official Coinbase customer service. In reality, any information entered on that site—such as login credentials, recovery phrases, or two-factor authentication codes—would be stolen and used to drain cryptocurrency wallets. This is a classic brand impersonation scam, and the domain was designed to exploit trust in the Coinbase name.

PhishDestroy identified this threat through multiple indicators. VirusTotal flagged the domain with 3 out of 95 security vendors marking it as malicious, which is a strong signal given the low false-positive rate for such platforms. The domain was created on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with low-effort phishing setups. It resolves to IP address 188.114.97.3, which is linked to Cloudflare, a content delivery network that scammers sometimes abuse to hide their true hosting location. The site had no SSL certificate, meaning any data sent to it was transmitted in plain text—another red flag. These technical details, combined with its presence on three security blocklists, confirm that this was a malicious operation.

If you visited nsdaiu3824nas.live and entered any information, act immediately. Change your Coinbase password and enable two-factor authentication if you haven't already. If you provided your recovery phrase, assume your wallet is compromised and move any remaining funds to a new wallet generated on a secure device. Run a security scan on your computer for any malware that might have been dropped. Finally, report the incident to Coinbase's security team and consider freezing your accounts. Remember, legitimate companies never ask for sensitive information through unsolicited support panels. Always verify URLs directly through official channels before interacting.