xn--oinbase-ux1c[.]com

Analysis indicates that the domain xn--oinbase-ux1c.com was registered on July 2, 2024 through Dynadot LLC and is currently resolved to the IP address 199.59.243.228. The address belongs to Amazon.com, Inc. (AS16509) and is hosted in the United States. The domain uses a Let’s Encrypt certificate issued for the current year, confirming that TLS is active. Authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net, both operated by the registrar.

The site presents the page title “ᴄoinbase.com”, a clear attempt to mimic the legitimate Base brand. Threat intelligence classifies the page as a crypto‑related scam employing the publicly known “Airdrop Scam” kit. The domain appears on one security blocklist, has been blocked by PhishDestroy, and VirusTotal reports eight detections out of ninety‑five scanners, reinforcing the malicious classification.

Infrastructure analysis reveals that the hosting provider is Amazon Web Services, a common choice for fast‑deployment phishing infrastructure. The Gridinsoft trust score of 0/100 aligns with the observed malicious indicators. The combination of a recent registration, use of a punycode domain that visually resembles the target brand, and a valid TLS certificate are typical tactics used to increase credibility and evade automated filters.

While the page content has not been directly inspected, the available metadata—page title, kit identification, blocklist presence, and VT detections—provide sufficient evidence for defensive action. Organizations should add xn--oinbase-ux1c.com to URL filtering and DNS block lists, monitor for any traffic to the associated IP, and consider sinkholing the domain to disrupt the campaign. Continuous observation of the IP and any related subdomains is advised, as the operators may pivot to new domains using the same hosting infrastructure.