coinbase-support[.]rnx[.]xka[.]mybluehost[.]me

Analysis of coinbase-support.rnx.xka.mybluehost.me indicates that the domain was registered on February 21, 2026 through Domain.com and is hosted on the infrastructure of mybluehost.me, using nameservers ns1.mybluehost.me and ns2.mybluehost.me. DNS resolution points to IP address 50.6.111.180, which is attributed to Oracle Corporation in the United States. The web server returns an HTTP 308 status code, and no TLS certificate is presented, meaning the site operates only over plain HTTP. The domain is flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that it is already being filtered by at least one external mitigation service. VirusTotal scans show that 11 of 93 security vendors have marked the domain as malicious, providing independent corroboration of its malicious nature.

The site is classified as a crypto‑related scam that impersonates the Coinbase brand, and the risk rating is high with an active status as of the report date, July 23, 2026. The evidence confirms that the infrastructure is legitimate hosting provided by Bluehost, but the lack of SSL and the redirect status suggest an attempt to funnel victims to a downstream payload or credential‑collection page. The absence of a certificate also makes the site more likely to be flagged by browsers that enforce HTTPS‑only policies. While the specific content of the landing page has not been analyzed, the combination of brand impersonation, crypto‑scam categorization, and multiple vendor detections strongly indicates a credential‑ harvesting or financial‑fraud operation targeting Coinbase users.

Defenders should add the IP address 50.6.111.180 to network‑level blocklists, enforce DNS filtering for the domain coinbase-support.rnx.xka.mybluehost.me, and ensure that any outbound connections to that host are denied.