coinbase[.]23458a[.]com

Analysis as of July 22, 2026 identifies the domain coinbase.23458a.com as an active brand‑impersonation infrastructure targeting the Google brand. The domain was registered through NameSilo, LLC on 21 February 2026 and is hosted on Cloudflare’s network (ASN 13335) with the IP address 172.217.18.4 located in the United States. The authoritative nameservers are fattouche.ns.cloudflare.com and maxine.ns.cloudflare.com. No TLS certificate is presented, indicating the site is served over plain HTTP. The page title returned from the server is “Google”, matching the declared impersonation target. Reputation signals are uniformly negative.

The Gridinsoft trust score is 0 out of 100, and the domain appears on three independent security blocklists. VirusTotal scans show two of ninety‑five antivirus engines flag the host, reinforcing the malicious classification. Additional blocking is observed from PhishDestroy, MetaMask, and SEAL, all of which have listed the domain as a known phishing or crypto‑scam vector. The listed scam type is “Crypto Scam”, consistent with the use of a Google‑related title to lure victims into credential or wallet theft. Because the domain is currently offline, active probing is limited to historical data.

The lack of an SSL certificate and the use of a Google‑related page title suggest the site previously attempted to mimic legitimate Google login pages to harvest credentials or cryptocurrency wallet information. However, the exact payload, landing page content, and any associated command‑and‑control infrastructure have not been captured, leaving those aspects uncertain. Defenders should continue to block coinbase.23458a.com at perimeter and DNS layers, monitor for any re‑registration attempts, and update detection signatures to include the observed nameserver pair and the specific IP address.