coinsecurity[.]digital

This domain, www.coinsecurity.digital, is actively flagged as a high-risk phishing site impersonating Google. Analysis indicates the domain was registered on March 3, 2026, through Global Domain Group LLC, and remains operational as of July 12, 2026. The site resolves to IP address 87.120.219.250 and presents a page title matching the targeted brand, further supporting the impersonation claim. Security vendors have detected this domain on two blocklists, and it appears in two threat intelligence pulses, reinforcing its classification as malicious infrastructure. Infrastructure analysis reveals the use of Google Web Server technology, HSTS, and HTTP/3, which may be employed to lend an appearance of legitimacy or to evade detection. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. While the presence of these technologies does not inherently confirm malicious intent, their combination with the domain's registration details and detection by security vendors raises significant concerns. The page content itself has not been fully analyzed, but the page title explicitly matches the targeted brand, aligning with typical brand impersonation tactics. Defenders should treat this domain as confirmed malicious infrastructure. The risk level is classified as high due to the domain's active status, its presence on multiple blocklists, and its detection by 13 out of 95 security vendors. Network-level blocking is recommended for this IP and domain to prevent potential credential theft or other fraudulent activities. Given the domain's recent creation and ongoing activity, continuous monitoring is advised to track any changes in hosting, SSL certificates, or associated infrastructure. If this domain is encountered in logs or user reports, it should be investigated as part of a broader phishing campaign targeting Google users.