ww25[.]cpcontacts[.]confirmcoinbase[.]com

The domain ww25.cpcontacts.confirmcoinbase.com was registered through ABOVE.COM PTY LTD. and delegated to the authoritative nameservers ns11.abovedomains.com and ns12.abovedomains.com. DNS resolution points to the address 199.59.243.228, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. The domain was created on September 25, 2025, and currently shows no SSL certificate, indicating that communications are unencrypted.

Analysis of public threat‑intelligence feeds reveals that the site appears on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal reports ten of ninety‑five scanners flagging the domain as malicious, reinforcing the suspicion of malicious intent. The site’s page title, confirmcoinbase.com, directly references the targeted brand, Coinbase, and the payload is associated with an “Airdrop Scam” phishing kit, a known cryptocurrency‑focused fraud vector. Gridinsoft assigns a trust score of 0 out of 100, suggesting an extremely low reputation.

The domain’s operational status is recorded as offline at the time of reporting, but historical activity indicates it was used for brand impersonation aimed at Coinbase users. Defenders should continue to monitor the IP address 199.59.243.228 for any resurgence, enforce blocklisting of the domain and its resolver IP across perimeter defenses, and update email and web‑filtering rules to detect references to “confirmcoinbase.com”. Additionally, organizations should educate users about unsolicited requests appearing to originate from Coinbase, emphasizing the lack of SSL and the typical characteristics of airdrop‑related scams. Uncertainty remains regarding the exact content served before takedown, as no visual inspection data is available; therefore, continuous intelligence gathering is recommended to capture any re‑deployment attempts.