coinbome[.]com

Analysis of coinbome.com confirms it as a high-risk phishing domain targeting users through an AMATAK-themed scheme. The domain, registered on February 21, 2026, via Gname.com Pte. Ltd., is currently offline with an HTTP 404 status, though historical data indicates active malicious use. Infrastructure analysis reveals it resolves to 27.102.107.155, hosted on AS45996 (DAOU TECHNOLOGY, KR), a network frequently associated with fraudulent activity. The SSL certificate, issued by Let's Encrypt (R12), is valid but provides no inherent trust, as phishing sites commonly exploit free certificates to appear legitimate. Detection data underscores its malicious classification: Google Safe Browsing flags it for social engineering, while PhishDestroy explicitly blocks it.

Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist. Nameservers (a10.share-dns.com, b10.share-dns.net) are consistent with bulletproof hosting patterns, further reducing traceability. The page title 'AMATAK' suggests a thematic focus, though the exact nature of the phishing lure—whether credential harvesting, malware distribution, or another scam type—remains unconfirmed due to the site's current offline status. Defenders should treat this domain as compromised.

Blocklist enforcement at the DNS and network layers is recommended, particularly for organizations with exposure to Korean-hosted infrastructure. The registration age (under six months) aligns with typical phishing lifecycle patterns, where domains are rapidly deployed and discarded. While VirusTotal detections are present, the absence of a full vendor breakdown limits granular threat attribution. Monitoring for re-emergence under the same infrastructure or related domains is advised, given the registrar's history with high-risk registrations.