ww25[.]xchange-coinbase[.]attrockford[.]com

Analysis of ww25.xchange-coinbase.attrockford.com shows an active infrastructure that impersonates the Coinbase brand. The domain was registered on 24 September 2025 through Tucows Domains Inc. and uses the authoritative name servers ns15.abovedomains.com and ns16.abovedomains.com. DNS resolution points to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site presents a valid TLS certificate issued by Let’s Encrypt under the YR1 identifier, but the certificate does not match the brand and therefore offers no credibility. An HTTP request returns a 302 redirect, a pattern often used to forward victims to a malicious landing page.

The page title returned by the server is "attrockford.com", providing no indication of the intended Coinbase impersonation. The observed scam type is a crypto scam, specifically an airdrop‑related phishing kit, as indicated by the "Airdrop Scam" classification. Threat intelligence aggregators have flagged the domain: five of ninety‑five VirusTotal scanners raise detections, and the domain appears on one external blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious reputation.

Security services such as PhishDestroy have already blocked the domain. While the exact landing page content has not been captured, the combined indicators—registrar profile, hosting on a cloud provider, low trust score, redirect behavior, and association with a known airdrop phishing kit—strongly suggest a high‑risk credential‑stealing operation targeting Coinbase users. Defenders should add the domain and its resolving IP to outbound allow‑list filters, enforce DNS sink‑holing, and monitor for TLS certificate anomalies that reference Let’s Encrypt for suspicious subdomains. Continuous re‑scanning with VirusTotal and inclusion in internal blocklists are recommended to mitigate exposure.