koinbay-login[.]es

The domain koinbay-login.es is a credential-phishing site that presents itself as a cryptocurrency exchange login portal. It does not impersonate a specific well-known brand but uses generic branding to deceive users into entering login credentials. The site is currently taken offline, reducing immediate risk, though its prior activity targeted users with fake login pages to harvest account details.

Technical indicators confirm the elevated risk of koinbay-login.es. The domain was flagged by 8 of 95 VirusTotal security vendors, including alphaMountain.ai, CyRadar, and Fortinet. It appears on 1 security blocklist (PhishDestroy) and was found in 1 AlienVault OTX threat intelligence pulse. The domain resolves to the IP address 185.149.120.107, hosted in Russia under AS57724 (DDOS-GUARD LTD). No SSL certificate was observed, and the page title displayed 'Koinbay login Exchange Platform | Koinbay Exchange Login to Account'. Registrar and creation date details are not available.

Users who may have interacted with koinbay-login.es should immediately change passwords for any accounts accessed through the site, particularly cryptocurrency exchange credentials. Enable two-factor authentication (2FA) on all sensitive accounts to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts. Report the phishing domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in broader mitigation efforts.