login[.]coinbaseinfo[.]email

The domain login.coinbaseinfo.email was observed serving a page whose title is "coinbaseinfo.email". Analysis links the site to an Airdrop Scam kit that is classified as a crypto scam and explicitly impersonates the Coinbase brand. Technical infrastructure shows the domain resolves to IP address 199.59.243.228, an address owned by Amazon.com, Inc. (ASN 16509) and geolocated to the United States. No SSL certificate was presented, indicating that traffic to the site is unencrypted. DNS queries for authoritative name servers returned NS_NOT_FOUND, suggesting the domain’s nameserver records are missing or concealed. An HTTP request at the time of capture returned a 200 OK status, confirming the server was reachable and delivering content. VirusTotal scans recorded 2 detections out of 95 security vendors, demonstrating that a minority of vendors flagged the domain as malicious. The domain appears on a single public blocklist, PhishDestroy, and the current operational status is reported as offline. Registration data indicates the domain was provisioned through the BODIS-A registrar, associated with the same ASN used for hosting.

Uncertainties remain regarding the exact page content beyond the title, as no visual or form details have been captured. The low detection count may reflect limited coverage by some security products, but the presence on PhishDestroy and the association with a known crypto‑scam kit provide sufficient evidence of malicious intent. Absence of SSL and missing nameserver information do not mitigate the threat but may affect automated detection mechanisms.

Defenders should proactively block any network traffic to 199.59.243.228 and add login.coinbaseinfo.email to URL deny lists. Email security solutions ought to treat messages containing this domain as malicious and quarantine them. Security operations centers should monitor for URLs containing the "coinbaseinfo.email" suffix and correlate alerts with the Airdrop Scam kit indicator set.