koinbae[.]com

The domain koinbae.com is currently active and is being used to impersonate Instagram, as indicated by the brand target field and the page title "KoinBAE — Koins Before Anything Else". The site returns an HTTP 301 redirect and is hosted on an Ubuntu server running Nginx, reachable at the IPv4 address 64.227.138.161. The IP belongs to AS14061 DigitalOcean, LLC and is geolocated to India. The TLS certificate is issued by Let’s Encrypt (E7), confirming the use of a free, automated certificate.

Registration data shows the domain was created on May 29, 2024 through GoDaddy.com, LLC, and it uses the default GoDaddy nameservers ns73.domaincontrol.com and ns74.domaincontrol.com. The infrastructure has been flagged by multiple security mechanisms: PhishDestroy has blocked the domain, it appears on one external security blocklist, and three of ninety‑five VirusTotal scanners have flagged it as malicious. Additionally, Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the host. The observed scam type is classified as social media phishing, targeting Instagram users.

While the exact landing page content has not been publicly analyzed, the presence of a brand‑specific page title and the redirection behavior suggest a credential‑harvesting intent. Defenders should immediately add koinbae.com and its resolved IP address to network‑level deny lists, enforce URL filtering for known blocklists, and monitor outbound connections to the hosting provider’s AS for any anomalous traffic. Continuous re‑scanning of the domain with sandbox and reputation services is recommended to capture any evolving payloads or changes in hosting. Updating internal threat intel feeds with the observed indicators of compromise (IOC) – domain, IP, nameservers, SSL fingerprint, and blocklist status – will aid in rapid detection and containment across enterprise environments.