ww25[.]hostmaster[.]hostmaster[.]www[.]bitcoinbase[.]io

On July 24, 2026 analysts reviewed the domain ww25.hostmaster.hostmaster.www.bitcoinbase.io, which was created on December 22, 2024 and registered through CommuniGal Communication Ltd. The domain resolves to IP address 199.59.243.228, an Amazon.com, Inc. host (AS16509) located in the United States. Nameserver records point to ns15.abovedomains.com and ns16.abovedomains.com. No TLS certificate is presented for the host, indicating that HTTPS connections are unavailable. The page title returned by the site – before it was taken offline – is "bitcoinbase.io", matching the recognizable part of the domain and reinforcing the brand‑impersonation intent toward Coinbase.

Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal scans show that seven of ninety‑five security vendors flagged the domain, and it appears on one external security blocklist. The domain is also listed as blocked by PhishDestroy. Intelligence tags the activity as a crypto‑scam employing an Airdrop phishing kit, and the brand target is identified as Coinbase.

The current operational status is offline, limiting direct observation of HTTP responses or payload content. Uncertainty remains regarding the exact phishing landing page, credential capture mechanisms, and any additional infrastructure beyond the observed IP and nameservers. Defenders should immediately deny network traffic to 199.59.243.228 and the associated nameservers, add the domain to local and cloud‑based blocklists, and monitor for newly registered domains that reuse the "bitcoinbase.io" keyword or similar sub‑domain patterns. Continuous review of vendor feeds for updates on the seven detecting engines and any resurgence of the domain is recommended.