ww7[.]coinbase[.]com[.]lc

This domain, ww7.coinbase.com.lc, was identified as a brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain was operational under a phishing scheme classified as an 'Airdrop Scam,' a type of crypto scam designed to deceive users into disclosing credentials or transferring assets. The domain resolved to IP address 199.59.243.228, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data interception. The page title, 'coinbase.com.lc,' directly mirrors the legitimate Coinbase domain, a common tactic to enhance credibility in phishing campaigns.

The domain appeared on one security blocklist and was flagged by 13 of 95 security vendors on VirusTotal, confirming its malicious classification. Gridinsoft assigned a trust score of 0/100, further validating its high-risk status. Nameserver records were unresolvable (NS_NOT_FOUND), which may indicate recent takedown efforts or infrastructure instability. The domain was blocked by PhishDestroy and is currently offline, suggesting mitigation actions have been taken. Defenders should treat this domain as a confirmed phishing threat.

Although it is no longer active, historical DNS and IP associations should be monitored for re-emergence. Network-level blocking of 199.59.243.228 and related subdomains under the coinbase.com.lc namespace is recommended. Security teams should review logs for connections to this domain or IP, particularly from endpoints involved in cryptocurrency transactions. No further content analysis is available; the exact phishing mechanics remain unverified beyond the 'Airdrop Scam' classification.