hiogwpce[.]login-coinbase-secured[.]com

On 25 July 2026, the domain hiogwpce.login-coinbase-secured.com was observed as part of a brand‑impersonation campaign targeting Coinbase users. The domain was registered on 21 February 2026 and immediately began serving content that returned the page title “login-coinbase-secured.com”. The title mirrors the brand name but no further page content has been publicly disclosed. DNS resolution points to the IPv4 address 15.197.130.221, which belongs to Amazon.com, Inc. (ASN 16509) and is geolocated to the United States. The hosting provider is therefore a cloud service that can be rapidly provisioned and torn down, a pattern common to short‑lived phishing infrastructure. The SSL certificate presented by the host is identified as “R12”, indicating a typical commercially‑issued certificate without extended validation.

Reputation scoring from Gridinsoft assigns a trust score of 0 / 100, reflecting a highly malicious reputation. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that 13 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of malicious intent. The campaign is classified as a crypto scam, leveraging the Coinbase brand to lure victims into disclosing credentials or transferring cryptocurrency. The risk level has been assessed as elevated, and the current operational status is offline, suggesting that the actors have either withdrawn the site or are rotating to new domains. While the available data confirm the domain’s malicious intent, several aspects remain uncertain.

The exact phishing kit or payload used, the full set of URLs under the same host, and any associated command‑and‑control infrastructure have not been disclosed. No evidence of additional redirects, credential‑stealing forms, or malware delivery has been captured in the public record.