kjmqihbw[.]login-coinbase-secured[.]com

This domain, kjmqihbw.login-coinbase-secured.com, is flagged as a brand impersonation threat targeting Coinbase users. Analysis indicates the infrastructure was designed to mimic the legitimate Coinbase login portal, likely to harvest credentials or facilitate unauthorized account access. The domain exhibits characteristics of a credential theft operation, though no specific drainer kit signatures have been confirmed at this time. The page title, www.kjmqihbw.login-coinbase-secured.com, further reinforces the attempt to deceive users into believing they are interacting with an official Coinbase service. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, and currently resolves to IP address 15.197.130.221, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain lacks an SSL certificate, a red flag for secure communications. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is not currently listed in Google Safe Browsing. The registrar details remain undisclosed, but the creation date suggests a recently established, likely short-lived malicious operation. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to end users. However, the infrastructure remains a residual risk due to its recent activity and detection by multiple security engines. Users who may have interacted with this domain are advised to reset credentials on the legitimate Coinbase platform and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The elevated risk level persists until further forensic analysis confirms the full scope of the operation and any linked infrastructure is dismantled.