aws-coinbase[.]com

This domain, aws-coinbase.com, was registered on 27 October 2025 through Dynadot LLC and is currently taken offline. The domain resolves to IP 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. DNS resolution uses the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. No SSL certificate is present, and an HTTP request returns a 200 status code with the page title “aws-coinbase.com”.

The site is associated with a crypto‑scam campaign that leverages an airdrop phishing kit and explicitly targets the Coinbase brand, indicating a brand‑impersonation motive. Threat intelligence sources have recorded six of ninety‑five VirusTotal scanners flagging the domain, and it appears on a single security blocklist. PhishDestroy has already blocked the domain. The risk level is elevated, and the offline status suggests the operators may be rotating infrastructure.

Evidence gaps include the actual content served before takedown and any additional payloads that may have been delivered. Defenders should continue to monitor the IP address 199.59.243.228 for potential re‑use, enforce domain‑level blocking for aws-coinbase.com, and add the associated IP to network‑level deny lists. Additional scanning of the IP and any future DNS records is advised, as well as sharing this indicator with threat‑share communities to improve detection of similar airdrop‑based crypto scams.