554793-coinbase[.]com

Analysis indicates that the domain 554793-coinbase.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is configured to resolve to the loopback address 127.0.0.127. The domain is currently offline, with no active HTTP response and without an SSL/TLS certificate, which precludes encrypted communications. Google Safe Browsing has flagged the site for social engineering, and ten of ninety‑three VirusTotal scanners have identified it as malicious. The domain appears on three reputable blocklists and is specifically listed by PhishDestroy, MetaMask, and SEAL as a prohibited resource.

The page title returned by the server is the literal domain string “554793-coinbase.com,” providing no additional context about the content hosted. The nameservers are listed as expired-ns1.niceisp.com and expired-ns2.niceisp.com, suggesting that the hosting arrangement is either abandoned or deliberately configured to expire. The domain is classified as a crypto‑related scam that impersonates the legitimate brand Coinbase, indicating an attempt to deceive users into providing cryptocurrency credentials or funds.

Because the site is offline, direct observation of the payload or credential‑capture mechanisms is not possible, leaving the exact phishing workflow uncertain. Defenders should continue to block the domain at network perimeter and endpoint layers, update detection rules to include the observed nameserver pattern and loopback IP resolution, and monitor for any re‑activation or re‑registration attempts. Collaboration with the registrar and the affected brand is recommended to accelerate takedown actions and to inform users of the impersonation attempt.