ww25[.]715561-coinbase[.]com

Analysis of ww25.715561-coinbase.com shows a short‑lived domain created on 21 December 2024 and subsequently taken offline. The domain was registered through OwnRegistrar, Inc. and uses a mixed set of nameservers (ns1.dns-parking.com, ns2.dns-parking.com, ns1.managedns1.com, ns2.managedns1.com, nu). DNS resolution points to 199.59.243.228, an address owned by Amazon.com, Inc. (AS16509) located in the United States. No TLS certificate was observed, indicating that the site operated only over HTTP.

The page title returned “715561-coinbase.com”, matching the domain string and confirming the intent to mimic the Coinbase brand. The infrastructure was identified as employing the publicly available “Airdrop Scam” phishing kit, a known crypto‑scam template that typically lures victims with promises of free token distributions. VirusTotal records indicate that 16 of 93 scanning engines flagged the domain as malicious, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious classification. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service.

The overall risk rating is elevated, consistent with a brand‑impersonation campaign targeting Coinbase users. Uncertainty remains regarding the exact content served before takedown, as the site is currently offline and no SSL certificate was present to capture HTTPS traffic. Defenders should continue to block the domain at perimeter filters, monitor the associated IP address for any resurgence, and update threat‑intel feeds with the observed indicators of compromise. Additional investigation of related subdomains or future registrations using similar naming patterns is recommended to pre‑empt potential re‑use of the same infrastructure.