ww25[.]261842-coinbase[.]comww25[.]261842-coinbase[.]com

The domain ww25.261842-coinbase.comww25.261842-coinbase.com was registered on November 19, 2024 through OwnRegistrar, Inc. and is currently offline. Infrastructure analysis shows that the domain resolves to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain uses four nameservers—a.dnspod.com, c.dnspod.com, ns1.managedns1.com, and ns2.managedns1.com—indicating a mixed DNS configuration that may be intended to obscure authoritative control. No TLS certificate is presented, meaning the site would have been served over plain HTTP, a common characteristic of low‑cost phishing infrastructure.

The page title returned from the host is "261842-coinbase.com," and the domain is explicitly listed as impersonating Coinbase, with the scam type classified as a crypto‑related airdrop scam. Detection services have flagged the domain: 12 of 93 VirusTotal scanners reported it as malicious, and it appears on at least one external security blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. PhishDestroy has already blocked the domain, confirming that threat‑intel feeds consider it a confirmed phishing vector.

While the site is no longer reachable, defenders should continue to block the associated IP (199.59.243.228) and the domain itself in network filters, DNS sinks, and endpoint protection policies. Monitoring for any re‑registration or similar sub‑domains that reuse the same nameserver set or IP range is advisable, as actors often recycle infrastructure. Organizations should also educate users about unsolicited crypto airdrop offers that claim to originate from Coinbase, reinforcing that legitimate communications from the brand never request private keys or seed phrases.