m[.]coinbasemedia[.]com

Analysis of m.coinbasemedia.com confirms it as a phishing domain targeting Coinbase users through a crypto airdrop scam. The domain was registered on October 27, 2025, via Dynadot LLC and uses nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, consistent with registrar-provided infrastructure. At the time of assessment, the domain resolved to IP 199.59.243.228, hosted on Amazon.com, Inc. (AS16509) in the United States. The site returned an HTTP 200 status, indicating an active page, though no SSL certificate was present, increasing the risk of unencrypted credential interception.

The page title, 'coinbasemedia.com,' suggests an attempt to mimic legitimate Coinbase media or promotional domains, though the exact content remains unanalyzed. Thirteen of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. The domain was blocked by PhishDestroy and is currently offline, though defenders should treat it as a confirmed threat due to its association with a known airdrop scam kit.

Infrastructure analysis reveals no unusual hosting patterns, but the lack of SSL and the use of a recently registered domain align with common phishing tactics. Defenders should add m.coinbasemedia.com to blocklists, monitor for related subdomains or typosquatting variants, and alert users to the risk of crypto-related scams impersonating Coinbase. If the domain resurfaces, further investigation into the hosting IP and nameserver activity is recommended.