876231-coinbase[.]com

Analysis indicates that the domain 876231-coinbase.com was registered on August 2 2026, using Cloudflare’s registrar service. The domain resolves to the IP address 172.67.190.73 and is served behind Cloudflare’s network, employing HTTP/3. The hosting infrastructure includes the nameservers june.ns.cloudflare.com and syeef.ns.cloudflare.com. The site appears on three public security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing classifies the URL as a social engineering threat.

VirusTotal scans have returned detections from 14 of 91 security vendors, reinforcing the malicious assessment. AlienVault OTX lists the domain in a single threat‑intel pulse. The domain remains active as of the report date, August 3 2026. No public information on SSL certificate details, HTTP response codes, page title, or page content has been disclosed, so those attributes remain unverified. Given the convergence of independent detection sources, defenders should treat the domain as high‑risk.

Recommended actions include adding the domain to DNS and proxy block lists, configuring email filters to quarantine messages containing the URL, and monitoring outbound traffic for connections to 172.67.190.73. Continuous re‑scanning with VirusTotal and updating intrusion detection signatures is advised. Organizations using Cloudflare services should verify that internal firewall rules explicitly deny traffic to this IP. The presence on multiple blocklists and the Google Safe Browsing flag provide sufficient justification for immediate mitigation without further investigation.