ww25[.]coinbase[.]sgdcg[.]com

The domain ww25.coinbase.sgdcg.com was registered on January 01, 2025 through DropCatch.com 357 LLC and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IP address 199.59.243.228, which belongs to ASN 16509 operated by Amazon.com, Inc. and is geolocated in the United States. The authoritative nameservers are ns15.abovedomains.com and ns16.abovedomains.com. No SSL certificate was observed for the host, indicating that HTTPS connections are not available. The page title returned by the server is "sgdcg.com", which does not reference the targeted brand.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a highly suspicious reputation. VirusTotal scans reported that three of ninety‑three security vendors flagged the domain, providing additional corroboration of malicious activity. The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy mitigation service. Intelligence indicates the site was designed to impersonate Coinbase and employed an airdrop‑scam phishing kit, a common vector for cryptocurrency fraud.

While the offline status limits immediate exposure, the combination of a low trust score, vendor detections, blocklist presence, and the use of a reputable cloud provider for hosting suggests a deliberate attempt to exploit Coinbase users. Defenders should ensure the domain is added to network‑level deny lists, monitor the associated IP range for any re‑use, and verify that any inbound traffic to the host is blocked. Continuous re‑evaluation of the IP reputation is advised, as cloud‑based infrastructure can be repurposed for new malicious campaigns. Organizations using Coinbase services should reinforce user awareness of unsolicited airdrop offers and confirm that legitimate communications originate from official Coinbase domains.