ww25[.]ticket-177269-coinbase[.]com

The domain ww25.ticket-177269-coinbase.com was registered on October 24, 2024 through OwnRegistrar, Inc. It resolves to the IP address 199.59.243.228, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. No SSL certificate is presented for the host, indicating that the service is delivered over plain HTTP. The authoritative nameservers are ns1.managedns1.com and ns2.managedns1.com, with a null entry observed for a third server. The page title returned by the HTTP response is "ticket-177269-coinbase.com", matching the domain itself and providing no additional context about the content.

VirusTotal analysis shows that 15 of 95 scanned security vendors flag the domain as malicious, and the domain appears on a single external blocklist. Independent threat intelligence sources have assigned a Gridinsoft trust score of 0 out of 100, and the domain is listed as blocked by PhishDestroy. The domain is categorized as a crypto‑related scam that impersonates the Coinbase brand, and it is associated with an "Airdrop Scam" phishing kit. Current monitoring indicates the site has been taken offline.

Analysts should continue to watch for re‑hosting attempts on other Amazon‑hosted IP ranges, and defensive teams should add the domain and its resolving IP to blocklists and intrusion‑prevention signatures. Because the site serves no TLS and lacks a valid certificate, network‑level TLS inspection would not raise additional alerts, so reliance on host‑based and reputation‑based controls is recommended. The combination of multiple vendor detections, a zero‑trust score, and confirmed brand impersonation confirms a high likelihood of malicious intent, and the domain should be treated as hostile until proven otherwise.