now-link[.]live

Analysis of now-link.live, taken offline as of July 24, 2026, shows a confirmed brand impersonation campaign targeting Coinbase users. The domain was registered on February 21, 2026 through Dynadot LLC and resolves to IP address 198.251.89.34, which belongs to AS53667 FranTech Solutions in the United States. No SSL certificate is present, indicating that any traffic to the site would be unencrypted. The page title returned from the site, "Coinbase Help Center," directly mirrors the official Coinbase support portal, reinforcing the intent to deceive visitors.

Infrastructure indicators include four authoritative nameservers—ns21.asurahosting.com, ns22.asurahosting.com, ns21.my-control-panel.com, and ns22.my-co—suggesting a distributed hosting setup often used to increase resilience against takedown attempts. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reflecting rapid detection by multiple anti‑phishing services. VirusTotal scans show that three of ninety‑three security vendors flagged the domain, providing additional corroboration of malicious intent.

Gridinsoft assigns a trust score of 0 out of 100, indicating extreme risk. Defenders should continue to block now-link.live at network perimeters, update URL filtering rules, and monitor for any resurgence or re‑registration attempts. Incident response teams should also verify that no credential harvesting endpoints remain reachable and consider informing affected Coinbase users of the impersonation attempt.