net[.]phengineering[.]coinbase[.]net[.]ph

On July 23, 2026, the domain net.phengineering.coinbase.net.ph was observed resolving to the IPv6 address 2a06:98c1:3105::6812:230f. The address is allocated to Cloudflare, Inc. (AS13335) and geolocated to the United States. The domain is registered through NFORCE_ENTERTAINMENT under ASN 43350; nameserver records could not be retrieved, indicating a possible attempt to obscure resolution infrastructure. The site was taken offline at the time of analysis, and its HTTP service returned no SSL certificate, suggesting that any prior communication would have occurred over unencrypted HTTP. Threat intelligence flags the domain as a crypto‑related impersonation of Coinbase.

The page title retrieved prior to takedown read “Coinbase Netherlands - bitcoins, ethereum en meer in het volste vertrouwen kopen”, directly referencing the target brand and using Dutch language to increase credibility among regional users. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal scans recorded 15 positive detections out of 95 antivirus and URL‑filtering engines, confirming that multiple independent vendors identify the host as malicious. PhishDestroy also listed the domain as blocked, reinforcing the consensus that the infrastructure is being used for phishing or crypto fraud. The evidence points to an active brand‑impersonation campaign leveraging Cloudflare’s CDN to mask the true origin of the malicious host.

The lack of SSL, missing nameserver data, and the offline status hinder a complete forensic reconstruction of the landing page and any credential‑harvesting mechanisms that may have been present. Defenders should continue to block the IPv6 address and the domain at perimeter filters, monitor for any re‑registration attempts, and incorporate the detection signature (15/95 VT positives, Gridinsoft score 0) into automated threat‑feed ingestion.