coinbasemedia[.]com

The domain coinbasemedia.com is currently listed as an offline crypto‑scam site that impersonates the Coinbase brand. Registration data show the domain was created on 27 Oct 2025 through Dynadot LLC and is served by the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution points to the IPv4 address 199.59.243.228, an Amazon.com, Inc. host (AS16509) located in the United States. No TLS certificate is present, and an HTTP GET returns a 200 status code, indicating that the web server is reachable despite the offline flag. The page title returned by the server is the literal string “coinbasemedia.com”, providing no additional branding cues.

Security telemetry indicates the domain appears on a single blocklist and is explicitly blocked by PhishDestroy. AlienVault OTX has recorded the domain in one threat‑intel pulse, and VirusTotal analysis shows 16 of 95 scanning engines flag the host as malicious. The observed payload aligns with an “Airdrop Scam” phishing kit, a known pattern used to lure cryptocurrency users with false airdrop offers. The overall classification is a crypto‑scam that leverages the reputable Coinbase identity to deceive victims. Evidence gaps remain regarding the exact content served at the URL, as the site has been taken offline and no visual or form data have been captured.

Consequently, analysts cannot confirm the presence of credential‑stealing fields or redirection behavior. Defenders should continue to enforce URL filtering for coinbasemedia.com, add the IP 199.59.243.228 to network‑level blocklists, and monitor for any future re‑registration of the domain or similar look‑alike variations. Updating endpoint and email security policies to flag communications referencing “airdrop” or “Coinbase” from unauthenticated sources will further reduce exposure. Ongoing threat‑intel feeds should be consulted for any resurgence of the Airdrop Scam kit or related infrastructure reuse.