localtmp[.]coinbase[.]property

localtmp.coinbase.property is an offline domain that was registered on 26 Oct 2024 through Porkbun LLC. The authoritative nameservers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com and salvador.ns.porkbun.com. DNS resolution points to 199.59.243.228, an address owned by AS16509 Amazon.com, Inc. located in the United States. No TLS certificate is presented, and the HTTP service has been taken offline; the site was blocked by the PhishDestroy sinkhole. Page title observed during prior scans is “coinbase.property”, matching the brand target Coinbase and indicating a crypto‑related impersonation.

The campaign uses an “Airdrop Scam” phishing kit, consistent with the reported Crypto Scam classification. Reputation services show a Gridinsoft trust score of 0 / 100 and six of ninety‑five VirusTotal scanners flagged the domain as malicious. The domain appears on one external security blocklist. Evidence from these indicators suggests the infrastructure was deliberately hosted on a cloud provider to leverage legitimate IP reputation while delivering a Coinbase‑branded airdrop lure.

Uncertainty remains around any active command‑and‑control endpoints because the site is offline and no further payload samples have been released. Defenders should add the IPv4 address to network deny lists, ensure that URL filtering solutions block the domain and any sub‑domains, and monitor Porkbun name servers for newly‑registered domains containing “coinbase”. Email gateways should be tuned to detect subject lines or body content referencing airdrop giveaways tied to Coinbase, and incident response teams should treat any related credential‑theft attempts as high priority. Continuous threat‑intel feeds should be consulted for re‑registration attempts or revived hosting on the same IP range.