accounts[.]coinbase[.]page

Analysis of the domain accounts.coinbase.page indicates that it was actively used for a cryptocurrency‑related brand impersonation campaign targeting Coinbase users. The site resolved to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting infrastructure is therefore provided by a major cloud provider, a pattern frequently observed in short‑lived phishing operations. The domain was registered through the BODIS‑A registrar, which is associated with the same ASN (16509). No TLS certificate was presented for the site, meaning the connection was unencrypted.

The page title returned by the server was “coinbase.page”, matching the brand target listed as Coinbase. Intelligence sources identified the use of an “Airdrop Scam” phishing kit, a known template that typically lures victims with promises of free cryptocurrency. The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy service. VirusTotal scans show that three of ninety‑five security vendors flagged the domain, providing additional corroboration of malicious intent.

The current operational status is offline, and the site is no longer reachable. Defenders should continue to block the domain at perimeter filters, add the associated IP address to deny lists, and monitor for any future re‑use of the same hosting resources. Because the infrastructure is hosted on a shared cloud platform, related sub‑domains may appear in subsequent campaigns; therefore, threat‑intel feeds should be queried for new domains resolving to 199.59.243.228 or other IPs owned by AS16509 that exhibit similar kit signatures or page titles. Continuous verification against blocklists and periodic VirusTotal rescans are recommended to capture any re‑activation attempts.