nadsa[.]lweb3[.]app

This domain nadsa.lweb3.app was registered on 21 February 2026 through Web Commerce Communications Limited dba WebNic.cc and is hosted on Cloudflare's network (AS13335, United States). The authoritative nameservers ns100.webnic.cc and ns101.webnic.cc resolve the domain to the IPv6 address 2606:4700:3030::6815:1001, which belongs to Cloudflare’s edge infrastructure. The site presented a TLS certificate issued by Cloudflare TLS Issuing ECC CA 1, indicating use of Cloudflare’s default SSL termination. The page title returned from HTTP(S) requests is “NADSA”, but no further content has been captured, so the specific phishing landing page cannot be described. Intelligence links the domain to a wallet/seed phishing campaign targeting Coinbase users; the brand target is explicitly listed as Coinbase.

VirusTotal analysis shows that two of ninety‑three scanned security vendors flagged the domain, and the domain appears on a single external security blocklist, specifically PhishDestroy, which has already taken the domain offline. Independent assessment by Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. No additional public blocklist entries or Safe Browsing detections are reported beyond the single blocklist entry. Defenders should block DNS resolution for nadsa.lweb3.app at the network perimeter and add the IPv6 address 2606:4700:3030::6815:1001 to any IP‑based deny lists.

Email filters should flag any messages containing URLs that resolve to this domain, and endpoint security solutions should treat any observed connections as malicious. Continuous monitoring of the registrar WebNic.cc for further domains created under the same account is advised, as the infrastructure could be reused. Because the site is currently offline, the immediate threat is mitigated, but the observed infrastructure—Cloudflare edge nodes, the same registrar, and the low trust score—suggests a repeatable pattern that may reappear with new domains.