ww25[.]coinbase-withdraw-verifications[.]starbuckssecretmenu[.]com

The domain ww25.coinbase-withdraw-verifications.starbuckssecretmenu.com was taken offline prior to the report date of July 24, 2026, but historical forensic evidence indicates it was actively used in a cryptocurrency‑related impersonation campaign targeting Coinbase users. The domain resolves to IP address 199.59.243.228, which is hosted in the United States under ASN 16509 belonging to Amazon.com, Inc. Nameservers 1107.ns1.abovedomains.com and 1107.ns2.abovedomains.com were observed, and the site operated without an SSL certificate, exposing any transmitted data to interception. Registration records show the domain was created on September 30, 2021 through GoDaddy.com, LLC, suggesting the infrastructure has been maintained for several years. The page title returned by the server was "starbuckssecretmenu.com," indicating the attacker leveraged a secondary brand name in the URL path to increase credibility, although the primary impersonated brand is Coinbase as noted in the intelligence.

A Gridinsoft trust score of 0 / 100 and inclusion on a single security blocklist reflect the malicious nature of the host. The site was identified as employing the Airdrop Scam phishing kit, a known pattern for crypto‑drain attempts, and was blocked by the PhishDestroy service. VirusTotal analysis recorded nine detections out of ninety‑five security vendors, reinforcing the classification as a malicious asset. Defenders should update intrusion detection signatures to flag the specific subdomain pattern "coinbase-withdraw-verifications" and block the associated IP address 199.59.243.228.

Email and web gateways should be configured to reject any communications referencing the domain or its parent zone starbuckssecretmenu.com. Ongoing monitoring of GoDaddy‑registered domains containing the "coinbase-withdraw-verifications" string is advised, as the threat actor may reuse the naming convention in future campaigns.