internal-coinbase[.]okta[.]com[.]se

The domain internal-coinbase.okta.com.se was registered on February 21, 2026 through Key-Systems Gmbh. The TLS certificate presented by the site is issued by a widely recognized certificate authority and carries the WE1 identifier. The domain resolves to the IP address 172.67.168.191, which is announced by AS13335 and geolocated to the United States. DNS resolution is handled by four nameservers (ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, ns4.centralnic.net). An HTTP 301 redirect is observed, and the server advertises support for HTTP/3, indicating use of a modern content delivery network infrastructure.

Infrastructure analysis shows the domain is hosted on a high‑capacity CDN platform, leveraging the same network that serves large‑scale web services. The page title returned by the server is "okta.com.se | 522: Connection timed out," suggesting that the endpoint is currently unresponsive or deliberately throttled. No additional page content has been captured, so the exact phishing payload or credential‑harvesting mechanisms remain unverified.

Threat intelligence flags the domain as a brand‑impersonation campaign targeting Coinbase, with a declared cryptocurrency scam motive. The domain appears on a single security blocklist and has been blocked by an external threat‑blocking service. VirusTotal analysis shows that 2 of 95 scanned security vendors have flagged the domain as malicious, providing limited but corroborating evidence of abuse. The domain’s active status and recent creation date indicate an ongoing operation.

Defenders should prioritize the addition of internal‑coinbase.okta.com.se to network and email filtering rules, monitor DNS queries for the associated nameservers, and enforce TLS inspection to detect any anomalous certificate usage. Continuous re‑evaluation of the domain’s content is advised, as the current lack of visible phishing pages leaves the full scope of the campaign uncertain.