gocoinlist[.]click

Analysis of gocoinlist.click, observed on July 23, 2026, indicates an active infrastructure used for Adobe brand impersonation. The domain was registered through Dynadot LLC on November 19, 2025 and resolves to the Cloudflare‑managed address 104.21.3.240, associated with ASN 13335 (Cloudflare, Inc.) and hosted in the United States. TLS termination is provided by Google Trust Services under the certificate label WE1, confirming the use of a legitimate certificate authority but not legitimizing the site’s content. HTTP requests return a 200 status code, and the page title "- Navigate the World of Digital Assets" is served, showing no direct reference to Adobe or a login portal; the exact page content has not been publicly analysed.

The hosting environment runs a Node.js stack with Vue.js and Express, and includes third‑party services such as Google Analytics, Google AdSense, Funding Choices, and Cloudflare’s HTTP/3 implementation. Nameserver delegation uses armfazh.ns.cloudflare.com and elsa.ns.cloudflare.com, consistent with the Cloudflare front‑end.

Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on a single security blocklist, and PhishDestroy has flagged it. On AlienVault OTX, the domain is present in one threat‑intel pulse. VirusTotal analysis shows 14 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion of phishing activity. The site is explicitly listed as impersonating Adobe, matching the declared scam type of brand impersonation.

Uncertainties remain regarding the exact payload delivered to victims, the presence of credential‑capture forms, or any redirect chain, as the page's visual or functional details have not been captured. Defensive operators should block communication with 104.21.3.240, enforce URL filtering for gocoinlist.click, and monitor for related indicator patterns such as the identified Node.js/Express stack and the specific page title.