latest-coinbsse-pro[.]umso[.]co

The domain latest-coinbsse-pro.umso.co was created on August 31, 2020 through Name.com, Inc. and is currently listed as offline. Technical probing shows the site returns an HTTP 404 status with the page title "Page not Found," indicating that the malicious landing page has been removed or taken down. The domain resolves to the IP address 75.2.96.155, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Hosting is provided by AWS, as evidenced by the four Amazon Route 53 nameservers: ns-1432.awsdns-51.org, ns-15.awsdns-01.com, ns-1794.awsdns-32.co.uk, and ns-900.awsdns-.

The TLS certificate is issued by Let’s Encrypt (R12), a free certificate authority commonly used by both legitimate and malicious operators. VirusTotal scans have flagged the domain on nine of ninety-five security vendor engines, and Google Safe Browsing classifies it as a social engineering threat. The domain appears on one known security blocklist and has been actively blocked by PhishDestroy, reinforcing the assessment that it was being used for phishing purposes.

Although the exact phishing kit or targeted brand is not disclosed, the combination of vendor detections, Safe Browsing flag, and blocklist presence establishes a credible risk. Defenders should continue to block the domain and its associated IP at perimeter defenses, monitor for any re‑activation or related subdomains, and consider adding the IP range to threat intelligence feeds. Ongoing vigilance is advised because the infrastructure, hosted on a flexible cloud platform, could be repurposed for future campaigns despite the current offline status.