462847coinbase[.]com

Analysis of the domain 462847coinbase.com identifies it as a brand-impersonation phishing domain. The domain is designed to mimic the legitimate Coinbase cryptocurrency platform, likely as part of a credential harvesting or account takeover campaign. The page title observed was 'Google', suggesting the threat actor used a deceptive redirect or blank page to evade initial detection while the underlying phishing kit remained active.

Technical indicators: VirusTotal flagged this domain with a score of 5 out of 95 security vendors, indicating low detection coverage. The domain was registered through NiceNIC International Group Co., Limited, a registrar known for its minimal abuse response. The domain resolves to IP address 172.217.18.4, which is associated with Google infrastructure, suggesting the domain may have used a legitimate hosting service for the phishing page. The domain was created on November 18, 2025, and appears on 1 security blocklist. Gridinsoft trust score is 0 out of 100, confirming malicious intent. Google Safe Browsing status is not explicitly listed but the domain is offline.

Current status: The domain has been taken offline and is blocked by PhishDestroy. The infrastructure is now inactive, but residual risk remains if the threat actor re-registers similar domains or uses the same hosting IP for future campaigns. Users who may have visited the domain before takedown should monitor their accounts for unauthorized access and change any credentials entered on the site. The registration date and low blocklist count suggest this was a relatively new and low-profile phishing operation.