login[.]coinbase[.]am[.]in

login.coinbase.am.in is an inactive domain observed to impersonate the cryptocurrency exchange Coinbase. The domain was registered on September 03, 2021 through the National Internet Exchange of India and resolves to the Amazon Web Services IP address 75.2.18.233, which belongs to ASN 16509 (Amazon.com, Inc.) located in the United States. No SSL certificate is presented and the authoritative nameservers could not be resolved (NS_NOT_FOUND). The site’s HTML title is “coinbase.am.in”, matching the domain string but providing no additional branding.

Google Safe Browsing classifies the site as a social‑engineering threat, and the domain appears on a single security blocklist. PhishDestroy has already taken the domain offline, and the current status is reported as taken offline. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious activity. VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the domain, reinforcing the suspicion.

The threat is cataloged as a crypto‑scam, consistent with the brand impersonation of Coinbase. Uncertainty remains around the specific payload or credential‑harvesting mechanisms because the site content has not been captured; the lack of an SSL certificate and the absence of reachable nameservers limit deeper HTTP inspection. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the IP address in new hostnames, and consider adding the IP 75.2.18.233 to threat‑intel feeds. Ongoing vigilance is recommended for any future domains that reuse the same registrar or hosting provider, as the infrastructure pattern suggests a low‑cost Amazon‑hosted staging environment for brand‑spoofing campaigns.