nlefyzij[.]coinbase[.]page

This domain, nlefyzij.coinbase.page, was identified as a confirmed phishing site targeting Coinbase users through an Airdrop Scam campaign. The domain was registered through BODIS-A and hosted on Amazon Web Services (AS16509) with a resolved IP address of 199.59.243.228 located in the United States. The page title was reported as 'coinbase.page', indicating an attempt to impersonate the legitimate Coinbase brand. Security analysis shows that 12 out of 95 security vendors on VirusTotal flagged this domain as malicious, and it appears on one security blocklist, specifically blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, reflecting a complete lack of trustworthiness.

The domain currently has no SSL certificate, and its nameservers are reported as NS_NOT_FOUND, suggesting the domain is no longer resolving or has been taken offline. The status is confirmed as offline as of the report date of July 23, 2026. Defenders should note that while the domain is currently inactive, the infrastructure used (Amazon cloud services and the BODIS-A registrar) may be reused for similar attacks. It is recommended to monitor for any new domains registered under the coinbase.page subdomain pattern or using similar naming conventions.

Network administrators should block the IP address 199.59.243.228 and consider adding the domain to blocklists proactively if not already included. End users who may have encountered this domain should be advised to avoid entering any credentials or seed phrases, and to change their Coinbase account passwords immediately if they interacted with the site. The exact visual content of the page has not been analyzed, but the classification as an Airdrop Scam suggests the site likely requested wallet connection or personal information under the pretense of a token distribution. No further brand or scam type details beyond those provided are available.