coinbase[.]jmx[.]de

The domain coinbase.jmx.de has been identified as a threat under the category of brand impersonation, specifically targeting Coinbase. This domain was set up to mimic Coinbase, a well-known cryptocurrency platform, potentially aiming to deceive users into divulging sensitive information. No specific drainer kit was detected in the analysis, but the infrastructure aligns with common phishing tactics associated with brand impersonation.

Technical indicators for coinbase.jmx.de include detection by 6 out of 95 security vendors on VirusTotal, highlighting its malicious intent. The domain is registered at jmx.de and resolves to the IP address 103.224.182.245. It was created on May 20, 2026, and utilizes an SSL certificate from Let's Encrypt. Currently, it is blocked by security solutions such as MetaMask, PhishDestroy, and SEAL and appears on three security blocklists. The domain's trust score is critically low at 0/100, according to Gridinsoft.

As of now, coinbase.jmx.de has been taken offline, reducing immediate threats. However, given its appearance on multiple blocklists and the presence of an SSL certificate, the domain posed a significant risk while active. Continued monitoring for any reactivation or new domains with similar patterns is advisable to mitigate potential phishing threats. Users are advised to remain cautious and verify domain authenticity before interacting with similar sites.