gitlab[.]coinbasesecure[.]vip

Analysis of gitlab.coinbasesecure.vip was performed on 23 July 2026. The domain resolves to the IPv4 address 75.2.18.233, which is allocated to Amazon.com, Inc. (AS16509) and geolocated to the United States. Registration data show the domain was created on 14 September 2024 through Dynadot LLC, and the authoritative name servers are ns1.dyna-ns.net and ns2.dyna-ns.net. No TLS certificate is presented; the site only supports plain HTTP, indicating an absence of encryption. The page title returned by the HTTP response is "coinbasesecure.vip", matching the registered domain name but offering no additional context. Threat intelligence flags the domain as a crypto‑related scam that impersonates the Coinbase brand.

VirusTotal analysis recorded 13 of 95 security vendors marking the domain as malicious, confirming that a substantial minority of scanners identify it as hostile. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, providing additional external validation of its malicious nature. Current network measurements indicate the domain is taken offline, which may be the result of takedown actions or temporary hosting changes. Because the site has been taken offline, the exact content and credential‑capture mechanisms remain unknown; no screenshots or HTML analysis are available. Nonetheless, the historical evidence demonstrates that the infrastructure was deliberately configured to host a brand‑impersonating cryptocurrency scam.

The lack of SSL, the use of generic dynamic name servers, and the reliance on Amazon‑hosted IP space are consistent with low‑cost, fast‑deployment attacker infrastructure. Defenders should continue to block the domain at the DNS layer and add 75.2.18.233 to outbound filtering rules, even though the IP is shared with legitimate Amazon services. Monitoring for re‑registration of the domain or for new subdomains under the same name‑server set is advisable.