app[.]coinbasex[.]info

The domain app.coinbasex.info was registered on November 20, 2024 through Porkbun LLC and is currently hosted on the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) in the United States. The domain resolves to four Porkbun nameservers: curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador. No SSL certificate was observed, indicating that the site was served without TLS encryption. The page title returned by the site was "coinbasex.info," matching the domain name and reinforcing the brand‑impersonation intent toward Coinbase.

Analysis of the site’s infrastructure identified the use of an Airdrop Scam kit, a known template for crypto‑related phishing campaigns. VirusTotal scans recorded 14 detections out of 95 security vendors, reflecting a moderate level of consensus among scanning engines that the domain is malicious. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming that at least one defensive feed has taken action against it. Current operational status is offline, which may be temporary or part of takedown efforts.

Defenders should consider adding the domain and its resolved IP address to network‑level blocklists, update URL filtering policies to deny traffic to the host, and monitor for newly registered domains that share the "coinbasex" pattern or similar Porkbun name server configurations. Continuous observation of the associated IP range is advised, as the hosting provider may be reused for other crypto‑related malicious sites. Given the confirmed use of a known airdrop phishing kit and the detection activity from multiple vendors, the domain should be treated as a confirmed threat targeting Coinbase users and flagged accordingly in incident response workflows.