ww25[.]fclzfdev[.]coinbase-pportal[.]com

This domain, ww25.fclzfdev.coinbase-pportal.com, is actively impersonating Coinbase as part of an airdrop-themed phishing operation. Analysis indicates the domain was registered on September 24, 2025, through Tucows Domains Inc., and currently resolves to the IP address 199.59.243.228. The site employs a Let's Encrypt SSL certificate, which provides encrypted connections but does not validate legitimacy. The page title, 'coinbase-pportal.com,' directly references the targeted brand, reinforcing its fraudulent intent to deceive users into believing it is an official Coinbase portal. Infrastructure evidence confirms the domain is running an 'Airdrop Scam' phishing kit, a common tactic used to lure victims with promises of cryptocurrency rewards. As of July 12, 2026, the domain remains active and is flagged by 13 out of 95 security vendors on VirusTotal, alongside listings on two security blocklists, including PhishDestroy and BLP-Malware. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. While the exact content of the phishing page has not been analyzed, the combination of brand impersonation, known phishing kit deployment, and blocklist presence provides sufficient evidence to classify this as a high-risk threat. Defenders should prioritize blocking this domain at the DNS and network levels, particularly for organizations handling cryptocurrency transactions or user authentication. The use of a subdomain (ww25.fclzfdev) suggests potential ties to a broader campaign, possibly leveraging dynamic or disposable subdomains for evasion. Monitoring for similar patterns, such as domains containing 'coinbase-pportal' or variations of the 'fclzfdev' prefix, may help identify related infrastructure. Given the domain's registration age and continued activity, takedown efforts should be pursued through the registrar and hosting provider to mitigate further abuse.