coinbase[.]you

Analysis of the domain coinbase.you shows a clear case of brand impersonation targeting Coinbase users. The domain was registered on December 5, 2025 through Dynadot LLC and resolves to the IP address 199.59.243.228, which is hosted in the United States under ASN 16509 owned by Amazon.com, Inc. The authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net. No SSL certificate is presented, indicating the site operates over plain HTTP. An HTTP request to the domain returns a 200 status code and the page title is exactly "coinbase.you", confirming the domain’s self‑identification.

VirusTotal scans have flagged the domain by seven of ninety‑five security vendors, providing independent corroboration of malicious intent. The site is associated with an “Airdrop Scam” phishing kit and is classified as a crypto‑related scam. It appears on a single security blocklist and has been taken offline, with PhishDestroy confirming its removal. The domain explicitly impersonates the Coinbase brand, aligning with the declared brand target.

Defenders should block the IP 199.59.243.228 at the network perimeter, deny DNS resolution for coinbase.you, and add the domain to internal URL filtering lists. Monitoring for similar domains registered through Dynadot or hosted on the same Amazon AS should be instituted, as the infrastructure pattern suggests potential reuse. Continuous verification of the blocklist status and re‑scanning by malware detection services are recommended to capture any re‑hosted content. The lack of an SSL certificate and the plain‑HTTP response reduce the effectiveness of TLS‑based inspection, so deep packet inspection should be configured to capture the clear‑text traffic if the domain becomes active again.