coinspot-x-doodles[.]site

Analysis indicates that the domain coinspot-x-doodles.site was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently taken offline. The site presented a page title of "Google", matching the declared brand impersonation of Google. Infrastructure assessment shows the domain resolves to 172.217.20.132, an address owned by Cloudflare (AS13335) located in the United States. No TLS certificate was observed, meaning the site served only HTTP.

The domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt and Codeesura—and received a Gridinsoft trust score of 0 / 100, indicating a lack of reputation. VirusTotal analysis recorded six detections out of ninety‑five scanning engines, confirming malicious classification by multiple vendors. The nameservers alexis.ns.cloudflare.com and jewel.ns.cloudflare.com are standard Cloudflare resolvers, offering no additional attribution. No content was captured because the site is offline, so the exact phishing page layout and credential‑harvesting mechanisms remain unknown.

While the domain is offline, the combination of brand‑impersonation metadata, low trust score, blocklist presence, and multiple vendor detections suggests a deliberate phishing campaign targeting Google users. Defenders should ensure the domain is denied at DNS and proxy layers, add the four blocklist entries to existing filtering rules, and monitor for any re‑registration or related sub‑domains that may reuse the same infrastructure. Continuous observation of Cloudflare‑hosted IP ranges for anomalous traffic patterns is advised, as is verification that internal users do not receive unsolicited communications referencing the "Google" page title. Given the current evidence, the threat should be treated as elevated and mitigated accordingly.