439812-coinbase[.]com

Analysis dated July 23, 2026 indicates that the domain 439812-coinbase.com is currently offline but exhibits multiple indicators of a high-risk brand-impersonation campaign targeting Coinbase users. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited. DNS resolution points to the loopback address 127.0.0.127 and the authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. No SSL certificate is present, meaning any HTTPS connection would be untrusted.

VirusTotal scans show that 16 of 95 security vendors have flagged the domain, confirming a consensus of malicious classification. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing marks the site for social engineering, reinforcing the phishing assessment. The listed scam type is "Crypto Scam," and the domain explicitly impersonates the Coinbase brand.

Because the site resolves to a loopback address and is offline, direct interaction is currently impossible, but the infrastructure suggests a typical credential-harvesting or wallet-draining operation. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re-hosting or new IP assignments, and update detection rules to include the observed registrar and nameserver patterns. Threat intelligence feeds should be refreshed to capture any resurgence, and users of Coinbase should be reminded to verify URLs and avoid entering credentials on untrusted sites. At this stage, the primary unknowns are the exact malicious payload and any associated command-and-control infrastructure, which remain unobserved in public scans.