demo[.]coinbaseinfo[.]email

The domain demo.coinbaseinfo.email was observed hosting a credential-collection site that targets the Coinbase brand. VirusTotal records show that ten of ninety‑five AV engines flagged the domain as malicious, indicating a moderate consensus among scanning services. The site is listed on a single security blocklist and has been actively blocked by PhishDestroy, confirming that defensive feeds are already aware of its activity. No TLS certificate was presented, and the HTTP response returned status code 200, allowing unencrypted traffic to be delivered.

Infrastructure analysis identifies the sole A record pointing to 199.59.243.228, an IP owned by Amazon Web Services (ASN 16509) located in the United States. Registration details reveal the domain was provisioned through the BODIS‑A registrar, which also uses the same ASN, and the nameserver query returned no results (NS_NOT_FOUND). The page title returned by the web server is “coinbaseinfo.email”, matching the domain name and reinforcing the impersonation intent. Threat actors appear to have employed the publicly available “Airdrop Scam” phishing kit, a template commonly used to lure victims with false cryptocurrency airdrop promises.

The campaign is classified as a crypto‑related scam, consistent with the brand impersonation of Coinbase. Because the domain is currently offline, ongoing monitoring is advised to detect any re‑activation or related infrastructure. Defenders should add the IP address 199.59.243.228 to network‑level deny lists, ensure that email filters block URLs containing “coinbaseinfo.email”, and consider sharing the indicator set with threat‑intelligence platforms to improve collective detection. The lack of DNS name‑server data and the absence of a TLS certificate introduce uncertainty regarding the full scope of the hosting environment; additional passive DNS and certificate transparency monitoring may reveal ancillary domains or sub‑domains used by the same operators.