ww25[.]comcomww25[.]secure-portal-coinbase[.]com

This domain, ww25.comcomww25.secure-portal-coinbase.com, is an active phishing domain targeting Coinbase users. Registered on November 24, 2024, through OwnRegistrar, Inc., the domain resolves to IP address 199.59.243.228, hosted on Amazon Web Services (AS16509 Amazon.com, Inc.) in the United States. The domain uses a nameserver mix including Cloudflare providers (mina.ns.cloudflare.com, sonny.ns.cloud) as well as other Managed DNS services (ns1.managedns1.com, ns2.managedns1.com). VirusTotal analysis flags this domain with 12 out of 93 security vendors marking it as malicious, confirming widespread detection across the security community.

The Gridinsoft trust score is 0/100, indicating high risk. The domain is listed on at least one security blocklist and is categorized as a crypto scam using an Airdrop Scam phishing kit. PhishDestroy has taken the domain offline as of the report date. No SSL certificate was observed for the domain.

The page title is "secure-portal-coinbase.com," which directly references the brand target Coinbase, though the exact content of the site has not been analyzed visually. Key indicators for defenders: the domain's reliance on Coinbase branding, the low trust score, the multi-vendor detection ratio, and the hosting on AWS infrastructure should be included in threat intelligence feeds. Organizations should block this domain and monitor for variations, as the phishing kit may be reused under different subdomains or similar registration patterns.