587291-coinbase[.]com

Analysis of 587291-coinbase.com shows a high‑risk brand‑impersonation infrastructure targeting Coinbase users. The domain was registered on February 19, 2026 through NiceNIC International Group Co., Limited and is currently taken offline. DNS resolves to 91.92.241.15, an address owned by AS202412 Omegatech LTD in the Netherlands, and the authoritative nameservers are ns1.virtualine.org and ns2.virtualine.org. No SSL certificate is presented, leaving the site without transport‑level encryption.

The HTTP response presents the page title "Checking Connection - Please Wait," which is consistent with a placeholder page often used in credential‑harvesting campaigns. VirusTotal records indicate that 16 of 93 scanned security vendors flag the domain as malicious, and the site appears on three independent security blocklists. Additional defensive feeds have listed the domain as blocked by PhishDestroy, MetaMask, and SEAL, while Google Safe Browsing classifies it under social engineering. The observed scam type is a crypto‑related scam, explicitly impersonating Coinbase, suggesting attackers may have attempted to lure victims into disclosing cryptocurrency credentials or transferring funds.

While the site is offline, the combination of registrar information, IP ownership, lack of TLS, multiple vendor detections, and blocklist listings provides strong evidence of malicious intent. Defenders should continue to block the domain at network perimeters, update intrusion‑detection signatures with the observed IP and nameserver data, and monitor for any re‑registration attempts. Users should be warned that any login prompt originating from this domain is fraudulent, and credential‑reuse protections should be enforced for Coinbase accounts. The current evidence does not reveal the underlying phishing kit or exact payload, so continued threat‑intel collection is advised to capture any future re‑deployment of the infrastructure.