ww25[.]287105-coinbase[.]com

Analysis of ww25.287105-coinbase.com indicates a brand impersonation campaign targeting Coinbase users, classified as a crypto scam. The domain was registered on November 10, 2024, through OwnRegistrar, Inc., and has since been taken offline. Infrastructure analysis reveals the domain resolved to IP address 199.59.243.228, hosted on Amazon.com, Inc. (AS16509) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data interception. Nameserver records include a.dnspod.com, c.dnspod.com, ns1.managedns1.com, and ns2.managedns1.com, with an additional null entry suggesting potential misconfiguration or evasion tactics.

The domain was flagged by 15 of 95 security vendors on VirusTotal and appears on at least one blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. The page title, '287105-coinbase.com,' aligns with the identified phishing kit labeled as an 'Airdrop Scam,' a common tactic in cryptocurrency fraud. While the exact content of the site remains unconfirmed due to its offline status, the available indicators—including the domain structure, registration details, and detection metrics—support its classification as a high-risk impersonation attempt.

Defenders should treat this domain as compromised and prioritize blocking it at the DNS and network levels. Monitoring for related subdomains or IP reuse is recommended, particularly within the AS16509 range. Given the domain's association with a known phishing kit, security teams should also review logs for connections to 199.59.243.228 or interactions with the listed nameservers. No further actionable intelligence is available at this time regarding the campaign's scale or victim targeting.