ww25[.]m[.]coinbase-wallrktscorn[.]com

This domain ww25.m.coinbase-wallrktscorn.com is currently active and resolves to the Amazon Web Services address 199.59.243.228 located in the United States under ASN AS16509 (Amazon.com, Inc.). The domain was registered on 24 September 2025 through Tucows Domains Inc. and uses the authoritative name servers ns15.abovedomains.com and ns16.abovedomains.com. TLS is provided by a Let’s Encrypt certificate (labelled YR2). An HTTP request receives a 302 redirect response, and the page title returned by the server is “coinbase‑wallrktscorn.com”, which directly references the targeted brand.

The site is identified as a crypto‑scam using an “Airdrop Scam” phishing kit and explicitly impersonates Coinbase. Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, the domain appears on one security blocklist, and PhishDestroy has already blocked it. VirusTotal analysis shows 15 of 95 scanning engines flag the domain as malicious. The limited detection surface suggests the site is in early stages of distribution but is already being leveraged by threat actors.

Uncertainty remains around the full payload delivered after the redirect and any additional infrastructure that may be shared with other malicious hosts. Defenders should immediately deny or sinkhole the IP address 199.59.243.228, add the fully qualified domain name to URL filtering and email gateway block lists, and monitor for similarly structured subdomains under the coinbase‑wallrktscorn.com pattern. Network telemetry should be inspected for outbound connections to the identified AWS IP range, and endpoint protection should be updated with indicators of compromise derived from the observed TLS fingerprint and HTTP redirect behavior. Continuous review of the registrar and name‑server records is advised, as changes may signal further campaign expansion.