coinnekt[.]live

Analysis of the domain coinnekt.live indicates it was a brand impersonation scam targeting Google, operational as of July 22, 2026. The domain resolved to the IP address 91.222.173.30, hosted on AS43641 (SOLLUTIUM EU Sp z.o.o.) in the Netherlands. Registration was handled through Vsys_USA (ASN 43641), with nameservers ns1-us.v-sys.org and ns2-us.v-sys.org. The page title, 'Coinnkt Web Solution | Digital Marketing & SEO Services for Business Growth,' does not directly reference Google, but the domain was explicitly flagged for Google brand impersonation in threat intelligence sources.

Detection data shows the domain appeared on one security blocklist (PhishDestroy) and was flagged by 2 of 93 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in available evidence. No SSL certificate was present, increasing the likelihood of interception or manipulation of unencrypted traffic. The domain has since been taken offline, though historical DNS records or cached content may still pose residual risks. Defenders should treat this domain as confirmed malicious based on its association with brand impersonation, hosting on a known bulletproof infrastructure, and detection by multiple security vendors.

Network-level blocking of the IP 91.222.173.30 and monitoring for related domains registered through Vsys_USA or using the same nameservers is recommended. Given the offline status, further forensic analysis of the site’s content is not possible, but the infrastructure patterns align with prior phishing campaigns targeting major tech brands. No evidence suggests this domain was part of a larger malware distribution or credential-harvesting kit, though the absence of SSL and the use of a non-branded page title may indicate an attempt to evade automated detection systems.