api[.]identifications-coinbase[.]com

Analysis of api.identifications-coinbase.com shows a confirmed brand‑impersonation campaign targeting Coinbase users. The domain was registered through Dynadot LLC on October 06, 2025 and resolves to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. An HTTP request returns a 200 status code, but the site does not present an SSL certificate, indicating unencrypted communications.

The page title reported by passive monitoring is "identifications-coinbase.com," matching the domain name and reinforcing the impersonation intent. VirusTotal records indicate that 5 out of 95 scanned security vendors flagged the domain as malicious, and the domain appears on one public blocklist, specifically PhishDestroy, which has already taken the site offline. Infrastructure details reveal the use of generic DNS providers ns1.dyna-ns.net and ns2.dyna-ns.net.

The campaign is classified as a crypto scam and is associated with an Airdrop phishing kit, suggesting that victims may be lured with fraudulent token giveaways. While the exact page content has not been captured, the combination of brand targeting, malicious detections, and known kit usage provides strong evidence of malicious intent. Defenders should block the domain at perimeter and DNS layers, monitor the associated IP range for related activity, and advise users to avoid any unsolicited Coinbase‑related communications that reference this URL.