d26-coinbase[.]go2run[.]space

The domain d26-coinbase.go2run.space was registered on March 31, 2026 through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and is currently resolved to the IP address 190.92.220.166. Its authoritative nameservers are vip3.alidns.com and vip4.alidns.com. Multiple security products have taken defensive action: PhishDestroy, MetaMask, and SEAL list the domain as blocked, and it appears on three external blocklists. Google Safe Browsing classifies the site as social engineering, indicating a high likelihood of credential‑stealing or fraudulent activity. VirusTotal scans show that two of ninety‑one security vendors flagged the domain, reinforcing the suspicion that it is being used for malicious purposes. The domain’s risk rating is high and its operational status remains active as of the report date, July 28, 2026.

Infrastructure analysis reveals a single‑point hosting model on a public IP without any publicly disclosed SSL/TLS details, which is typical for low‑cost phishing infrastructure. No page title, content snapshot, or explicit brand targeting information has been published in the available intelligence, leaving the exact phishing lure unclear beyond the implication of a “coinbase” keyword in the subdomain. Consequently, defenders cannot confirm the specific victim brand but should treat the domain as a generic credential‑theft vector.

Given the observed detections, organizations should proactively block DNS resolution for d26-coinbase.go2run.space at network perimeters and endpoint security solutions. Continuous monitoring of the associated IP 190.92.220.166 and the registrar’s name server records is advised, as threat actors may pivot to adjacent subdomains or relocate hosting. Security teams should also ingest the domain into threat‑intel feeds and update URL filtering policies to mitigate exposure to any future payloads that may be delivered from this infrastructure.