Criticalscore 63 · flagged Tuesday, October 6, 2026

092375coinbase.com

Appeared in the .com zone on Tuesday, October 6, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: coinbase
+30
brand plus digits
matched: 092375coinbase
+8
random-looking name
matched: H=3.81
+5
brand name behind Cloudflare
matched: cloudflare.com
+6
brand name at a retail registrar
matched: NICENIC INTERNATIONAL GROUP CO., LIMITED
+8
brand name at a watch-list registrar
matched: NICENIC INTERNATIONAL GROUP CO., LIMITED
+6
Registrar
NICENIC INTERNATIONAL GROUP CO., LIMITED
Nameserver provider
Nameservers
cleo.ns.cloudflare.com, maleah.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
—
Has a form
no
Brand echoed
coinbase

Model opinions

Second opinionlooks like abusetarget: Coinbaseconfidence 80%· claude-opus-5-5

The name 092375coinbase.com pairs the distinctive Coinbase brand with a random digit prefix, registered at NiceNIC behind Cloudflare. The page shows only a custom dark 'Verifying your connection' gate (not Cloudflare's standard challenge) with no links or form. This cloaking-style interstitial is typical of crypto phishing or drainer kits, but no impersonating content is visible yet, so this is a brand-squat rather than confirmed phishing.

First passsuspicioustarget: Coinbaseconfidence 72%· claude-haiku-4-5

Domain name contains 'coinbase' with prepended digits (092375coinbase.com), a common typosquat pattern. The page shows only a generic 'Verifying your connection' loading screen with no actual Coinbase branding, login form, or content visible. While the infrastructure (Cloudflare NS, retail registrar) and domain shape are consistent with phishing setup, the current page content is insufficient to confirm impersonation—it may be an incomplete deployment, redirect, or legitimate service using a bra

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, October 6, 2026

Screenshot of 092375coinbase.com taken by the zone census on 2026-10-06

Same data as JSON: /api/zone/domain/092375coinbase.com. This page is not indexed by search engines and does not link to the site it describes.