koinbay-login[.]net

Analysis of koinbay-login.net indicates that the domain was registered on 21 February 2026 and is currently taken offline. The site was identified as a credential phishing operation and has been blocked by the PhishDestroy network. Reputation services assign it extremely low trust scores, with Scamadviser reporting a 1 out of 100 rating and Gridinsoft a 0 out of 100 rating. The domain appears on a single security blocklist, and VirusTotal scans show that three of ninety‑three antivirus engines flagged the domain as malicious.

No additional infrastructure data such as registrar, ASN, hosting IP, or SSL certificate details are available in the current intelligence set, limiting the depth of the technical profiling. The limited detection footprint suggests a short‑lived campaign that was likely abandoned or taken down shortly after deployment. Defenders should ensure that the domain is added to local deny lists and that any outbound connections to it are blocked at the perimeter. Monitoring for newly registered domains that share the “koinbay‑login” naming pattern or that exhibit similar low‑trust scores may help to pre‑empt replication of this campaign.

Because the site is offline, active probing is not possible; however, historical DNS resolution data should be reviewed for any residual IP addresses that may have been used by the operator. Continuous ingestion of threat‑intel feeds that reference the three VirusTotal detections will aid in correlation with other observed malicious activity. In summary, koinbay-login.net represents a confirmed credential phishing vector with minimal but concrete indicators of compromise, and immediate blocking is recommended.