9g1y9t[.]093748coinbase[.]com

Analysis indicates that the domain 9g1y9t.093748coinbase.com was registered on June 11 2026 through MAT BAO CORPORATION. The domain resolves to the IPv4 address 15.197.240.20 and is served by the nameservers ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended-. The inclusion of the string “coinbase” suggests an attempt to impersonate the Coinbase brand, consistent with the generic phishing classification. VirusTotal has recorded detections from six of ninety‑one scanning engines, demonstrating that multiple security products consider the host malicious.

The domain is currently listed on a single external blocklist and has been explicitly blocked by the PhishDestroy sinkhole, confirming active mitigation by at least one anti‑phishing service. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or content analysis is available at this time, leaving the exact payload and victim interaction unknown. The domain’s age of less than two months points to a short‑lived infrastructure likely designed to evade reputation systems. Defenders should add the domain and its resolving IP address to network‑level deny lists, ensure that email filters flag any messages containing the domain, and monitor for related subdomains.

Continuous re‑scanning on VirusTotal and periodic queries of blocklist feeds are advised to capture any changes in detection status. Security operations may consider sinkholing the IP 15.197.240.20 to disrupt potential command‑and‑control traffic and watch for new domains registered by the same registrar in the near term. The active status and elevated risk rating warrant immediate inclusion in intrusion‑prevention policies while further forensic investigation proceeds.