ww25[.]web[.]coinbase-wallrktscorn[.]com

The domain ww25.web.coinbase-wallrktscorn.com is currently flagged as a high‑risk brand‑impersonation site targeting Coinbase users. Analysis indicates the domain is actively serving content and is listed on at least one security blocklist, confirming its malicious status. The page title returned by the server is "coinbase-wallrktscorn.com," aligning with the observed impersonation intent.

Infrastructure details show the domain was registered on September 24, 2025 through Tucows Domains Inc. and is delegated to the authoritative nameservers ns15.abovedomains.com and ns16.abovedomains.com. DNS resolution points to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The web server presents a valid Let's Encrypt certificate (YR2) and responds to HTTP requests with a 302 redirect, a behavior commonly used to forward victims to additional malicious payloads.

Threat intelligence reports identify the site as employing an "Airdrop Scam" phishing kit, categorised as a cryptocurrency‑related scam. VirusTotal scans have recorded 13 detections out of 95 security vendors, and the Gridinsoft trust score for the domain is 0 out of 100, reflecting a strong consensus of malicious intent. The domain is also blocked by the PhishDestroy blocklist, reinforcing its presence on active defensive feeds.

Defenders should immediately block both the domain ww25.web.coinbase-wallrktscorn.com and its associated IP address 199.59.243.228 at perimeter and endpoint layers. Continuous monitoring of DNS queries for the listed nameservers and the registrar Tucows may reveal additional related infrastructure. Security teams are advised to update URL filtering and email protection rules to capture the 302 redirect pattern and to share indicators of compromise with broader threat‑sharing communities to mitigate further propagation of this Coinbase‑impersonation campaign.