remote[.]login-coinbase-secured[.]com

The domain remote.login-coinbase-secured.com was registered on November 23, 2024 through Hosting Concepts B.V. d/b/a Registrar.eu and currently shows no SSL certificate. DNS resolution points to the IP address 15.197.130.221, which is owned by Amazon.com, Inc. (AS16509) and geolocated to the United States. The host resolves without TLS, indicating that any data submitted would be transmitted in cleartext. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy, confirming that at least one security provider has taken remediation action.

VirusTotal analysis reports that 15 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of malicious intent. The page title observed during reconnaissance is "login-coinbase-secured.com," and the infrastructure explicitly impersonates the Coinbase brand, aligning with the reported crypto‑scam classification. Nameserver records include alpha.alexhost.com, beta.alexhost.com, ina1.registrar.eu, ina2.registrar.eu, and ina3.re, suggesting the use of both AlexHost and Registrar.eu services for DNS management.

The site’s current operational status is offline, which may indicate takedown or temporary suspension, but the underlying infrastructure remains observable. Defenders should block the domain and the associated IP address at perimeter defenses, update URL filtering lists, and monitor for any resurgence of the host. Threat hunters should correlate any outbound traffic to 15.197.130.221 with credential‑theft or cryptocurrency‑related activity, and analysts should watch for re‑registration attempts using similar naming patterns that target Coinbase users.