diagnose-google[.]com

This domain, diagnose-google.com, is flagged as a high-risk brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. The site mimics the Coinbase login interface, as evidenced by the page title 'Coinbase - Sign In,' and is designed to harvest user credentials or facilitate unauthorized transactions. No drainer kit signatures were explicitly identified in available intelligence, but the domain's structure and content align with credential phishing campaigns commonly deployed against financial services. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 76.13.99.249, hosted under AS47583 (Hostinger International Limited). VirusTotal reports 20 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on three security blocklists, and no SSL certificate was detected, further reducing its legitimacy. The creation date suggests either a typo or an attempt to evade detection by appearing newly registered. As of the latest assessment, diagnose-google.com has been taken offline, likely in response to reports from security entities such as PhishDestroy, MetaMask, and SEAL. However, residual risk persists due to the potential for re-registration or migration of the phishing infrastructure to alternative domains. Users who may have interacted with this site are advised to immediately revoke any active sessions, reset credentials, and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.