login[.]dept-coinbase[.]com

login.dept-coinbase.com was observed on 23 July 2026 as an active credential‑harvesting site that targets Coinbase users. The domain resolves to the IPv4 address 15.197.130.221, which is hosted within Amazon’s AS16509 network in the United States. No TLS certificate is presented, and HTTP requests return a 200 status code, indicating that the site is reachable without encryption. The domain was registered on 4 September 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and uses four authoritative name servers: ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu, and josh.ns.cloudflare.com.

The page title returned by the server is “dept-coinbase.com”, matching the domain label and reinforcing the impersonation of the Coinbase brand. VirusTotal analysis shows that seven of ninety‑five scanning engines have flagged the domain as malicious, and the site appears on at least one public security blocklist. PhishDestroy has already added the domain to its blocklist, confirming that it is recognized as a high‑risk crypto‑scam vector. The lack of an SSL certificate, combined with the clear HTTP 200 response, suggests the operators are not attempting to hide the traffic but rely on brand recognition to lure victims.

Current intelligence does not reveal the exact phishing kit or backend infrastructure beyond the Amazon hosting environment. Defenders should block the domain at network perimeter, monitor DNS queries for the listed name servers, and add the IP address 15.197.130.221 to threat‑intelligence feeds. Continuous re‑scanning with updated antivirus engines is advised, as additional detections may emerge. Organizations should also educate Coinbase users about the absence of HTTPS on fraudulent login portals and encourage verification of legitimate URLs.