ww25[.]cdn[.]195482-coinbase[.]com

This domain, ww25.cdn.195482-coinbase.com, is flagged as an airdrop scam impersonating Coinbase. Infrastructure analysis reveals the domain was registered on October 4, 2024, through OwnRegistrar, Inc., and currently resolves to the IP address 199.59.243.228, hosted on Amazon.com, Inc. (AS16509) in the United States. The domain uses nameservers ns1.managedns1.com, ns1.priv4sys.com.iwantdemo.com, ns2.managedns1.com, and ns2.priv4sy, which may indicate the use of bulletproof or misconfigured DNS providers commonly associated with fraudulent activity. No SSL certificate is present, increasing the risk of unencrypted data interception.

The page title, '195482-coinbase.com,' directly references the Coinbase brand, aligning with the reported scam type of an airdrop fraud scheme. Detection data shows the domain appears on one security blocklist and is blocked by PhishDestroy. Sixteen of 95 security vendors on VirusTotal flagged the domain as malicious, providing concrete evidence of its fraudulent nature.

The domain is currently offline, but its infrastructure remains a potential threat vector. Defenders should treat any residual DNS records, subdomains, or related IPs as high-risk and monitor for reactivation or migration to new domains. Given the use of a known phishing kit and the explicit brand impersonation, organizations should update blocklists to include this domain and its associated infrastructure, such as the resolving IP and nameservers, to prevent future exploitation.