ww25[.]xttpn4xrek[.]phpmyadmin[.]confirmcoinbase[.]com

This domain, ww25.xttpn4xrek.phpmyadmin.confirmcoinbase.com, is assessed as an elevated-risk crypto scam impersonating Coinbase. Analysis indicates the domain was registered on September 25, 2025, through ABOVE.COM PTY LTD, with nameservers ns11.abovedomains.com and ns12.abovedomains.com. It resolved to IP 199.59.243.228, hosted on Amazon.com, Inc. (AS16509) infrastructure in the US. No SSL certificate was detected, increasing susceptibility to interception. The page title, confirmcoinbase.com, directly references the targeted brand, and the domain was classified as an airdrop scam by available threat intelligence.

As of the report date, the domain is offline, though it remains flagged by 12 of 95 security vendors on VirusTotal and appears on at least one security blocklist. PhishDestroy has blocked the domain, and Gridinsoft assigned a trust score of 0/100. Defenders should note the absence of SSL and the use of a subdomain structure (ww25.xttpn4xrek.phpmyadmin) that may attempt to obscure malicious intent or mimic administrative panels. The hosting provider and registrar details provide actionable pivot points for further investigation or takedown requests.

While the domain is currently inactive, its infrastructure and registration details suggest it was part of a larger campaign. Organizations should monitor for similar subdomain patterns, particularly those combining phpmyadmin or other administrative references with brand names. Blocking the resolved IP and associated nameservers may mitigate residual risk. Given the airdrop scam classification, defenders should also review logs for connections to this domain or IP from internal assets, particularly those involved in cryptocurrency transactions or communications.