a7rmm8[.]coinbase[.]property

The domain a7rmm8.coinbase.property was registered on October 26, 2024 through Porkbun LLC and is served by the nameservers curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador.ns.porkbun.com. DNS resolution points to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. No SSL certificate was observed for the domain, indicating that traffic is unencrypted and that the site did not deploy HTTPS. The page title returned by the server is "coinbase.property," directly matching the brand target Coinbase and confirming the intent to impersonate the legitimate service.

VirusTotal analysis recorded detections from five of ninety‑five security vendors, providing independent corroboration of malicious behavior. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the classification as a high‑risk entity. The site was identified as a crypto‑focused scam employing an Airdrop phishing kit, a pattern commonly used to lure cryptocurrency users with promises of free tokens. PhishDestroy has already taken the domain offline, and it appears on a single security blocklist at the time of reporting.

Although the site is no longer active, the underlying infrastructure—particularly the Amazon‑hosted IP—remains a viable vector for future malicious deployments. Defenders should immediately block the domain and its associated IP address at network perimeters, monitor for new domains registered with the same registrar or using identical nameserver patterns, and incorporate the observed detection signatures into endpoint and email security policies. Continuous threat‑intel feeds should be consulted for any resurgence of the Airdrop kit or related brand‑impersonation campaigns targeting Coinbase users.