098654coinbase[.]com

Analysis of 098654coinbase.com indicates a recent cryptocurrency‑focused impersonation of the Coinbase brand. The domain was registered on December 9, 2025 through NameSilo, LLC and is served by the dnsowl.com name server cluster (ns1, ns2, ns3). DNS resolution points to the IPv4 address 101.99.91.166, which belongs to the AS45839 Shinjiru Technology Sdn Bhd network located in Malaysia. No TLS certificate was observed, confirming that the site was reachable only via HTTP. The page title returned by the server is the domain itself, “098654coinbase.com”, and no additional content has been captured.

Threat intelligence sources have flagged the domain. AlienVault OTX includes it in a single pulse, and VirusTotal recorded detections from 12 of 95 scanned security vendors. The domain is listed on one public blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. The campaign is labeled as a crypto scam and specifically targets Coinbase users.

The current status is offline, which may limit immediate observation of malicious payloads, but the infrastructure components—Malaysian hosting, low‑reputation name servers, and a null SSL configuration—are consistent with previously observed credential‑stealing or crypto‑draining operations. Defenders should add 101.99.91.166 and the associated ASN to network‑level blocklists, monitor for any resurgence of the domain or similar patterns, and ensure that email and web filters reference the known blocklist entry. Continuous review of future registrations from the same registrar and name‑server set is advisable, as threat actors often recycle these assets. Awareness campaigns reminding users that Coinbase will never request private keys or send unsolicited payment requests can reduce successful exploitation.