login[.]coinbase[.]deal

The domain login.coinbase.deal was observed as part of a brand‑impersonation campaign aimed at Coinbase users. Infrastructure analysis shows the domain resolved to IP 199.59.243.228, an address owned by Amazon.com, Inc. (ASN 16509) and geolocated to the United States. No TLS certificate was presented, meaning the site operated only over HTTP, which lowers the barrier for man‑in‑the‑middle manipulation. The server returned the page title “coinbase.deal”, directly echoing the domain suffix and reinforcing the intent to masquerade as a Coinbase login portal. Malware and phishing analysis linked the site to an “Airdrop Scam” kit, a known template that promises fraudulent cryptocurrency giveaways to lure victims.

Reputation services assign a Gridinsoft trust score of 0 / 100, indicating extreme untrustworthiness, and the domain appears on a single security blocklist. VirusTotal scans recorded three detections out of 95 antivirus engines, confirming malicious classification. The domain has been taken offline, and commercial blocklist PhishDestroy lists it as blocked. Nameserver data is unavailable (NS_NOT_FOUND).

Although the site is currently inactive, the underlying hosting infrastructure (Amazon AS16509) is frequently reused by malicious actors, so the threat may reappear under a different hostname. Defenders should immediately block outbound connections to 199.59.243.228, enforce TLS‑only policies for all web traffic, and add the hostname to internal deny‑lists. Continuous monitoring of the Amazon ASN for similar unresolved domains is recommended. Organizations should educate users to ignore unsolicited airdrop offers and verify URLs against the official Coinbase domain (coinbase.com), and they should incorporate this indicator into threat‑intel feeds to improve early detection of related campaigns.