ww16[.]coinbasekyc[.]reqauest-updateaccount[.]info

This domain, ww16.coinbasekyc.reqauest-updateaccount.info, was observed hosting a credential‑collection site that masquerades as Coinbase. The page title returned by the web server is “reqauest-updateaccount.info”, which aligns with the malicious domain name and reinforces the brand‑impersonation intent. VirusTotal records show that 13 of 95 security scanners flagged the domain as malicious, indicating a moderate level of detection across the security community. The site was served without an SSL/TLS certificate, exposing any client connections to clear‑text interception.

Network resolution points to the IP address 75.2.18.233, which belongs to Amazon.com, Inc. (ASN 16509) and is geolocated in the United States. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single known security blocklist, confirming its reputation as unsafe. PhishDestroy has already taken the domain offline, and the current status is listed as “offline”. Registration details reveal the domain was provisioned through the AMAZO‑4 registrar, also linked to ASN 16509.

The infrastructure shares characteristics with other crypto‑related scams that target Coinbase users, and no legitimate service is associated with the host. Defenders should continue to block the domain and its resolved IP at network perimeters, enforce TLS inspection for outbound HTTP to unknown hosts, and monitor for any future re‑use of the Amazon‑hosted IP range in similar campaigns. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to rotate their Coinbase passwords and enable multi‑factor authentication.