securecoinbaselogclientid[.]online

The domain securecoinbaselogclientid.online was registered on February 21, 2026 and is presently taken offline, but historical artifacts indicate a targeted crypto‑related impersonation of Coinbase. HTTP requests to the domain resolved to the IP address 199.15.163.138, which is hosted by Wix.com Ltd. under ASN 58182 and geolocated to the United States. The TLS certificate presented an R12 rating, and the page title observed during the brief active period was "Coinbase - Sign in," directly matching the brand target of Coinbase and the listed scam type of a crypto scam.

VirusTotal scans recorded twelve detections out of ninety‑five security vendors, confirming that multiple anti‑malware engines identified the domain as malicious. Independent reputation services reported a Gridinsoft trust score of zero out of one hundred and noted the domain’s presence on a single security blocklist. The domain was also flagged and blocked by the PhishDestroy service.

Although the site is no longer reachable, defenders should retain the indicator set—including the fully qualified domain name, the associated IP address, the registration timestamp, and the observed TLS fingerprint—in their threat‑intel repositories. Adding the domain to internal blocklists, monitoring for new sub‑domains or similarly structured names on the same hosting provider, and correlating traffic to the AS58182 network can help pre‑empt reuse of the same infrastructure. The available evidence does not reveal additional payloads, command‑and‑control endpoints, or post‑exploitation activity, so the primary mitigation focus remains on domain‑level blocking and host‑based detection of any residual artifacts.