dymijkps[.]login-coinbase-secured[.]com

The domain dymijkps.login-coinbase-secured.com was registered on 21 February 2026 and resolves to the Amazon‑owned IP address 15.197.130.221, located in the United States and announced by AS16509 (Amazon.com, Inc.). The site is currently reported as offline, but historical observations show that it was used for a cryptocurrency‑related scam impersonating the Coinbase brand. The page title returned by the server is “login‑coinbase‑secured.com”, which directly mirrors the targeted brand name and aligns with the classified “Crypto Scam” payload. VirusTotal has recorded 13 detections out of 93 scanning engines, indicating that a minority of security products flagged the domain as malicious at the time of analysis.

The domain appears on one public blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one anti‑phishing consortium has taken action against it. The SSL certificate presented by the host is identified as “R12”, a standard certificate that does not provide any additional trust signals and is typical of opportunistic phishing infrastructures. Evidence from the available intelligence suggests that the infrastructure relies on a generic hosting provider rather than a dedicated command‑and‑control platform, which is consistent with a low‑complexity, short‑lived scam campaign.

No further technical artifacts such as malware hashes, C2 URLs, or post‑exploitation tools have been disclosed, leaving the full extent of the operation uncertain. Defenders should continue to block the IP address 15.197.130.221 at perimeter controls, add the domain to URL filtering and phishing‑ detection rules, and monitor for any re‑registration attempts or similar sub‑domains that reuse the “login‑coinbase‑secured.com” pattern.