assets[.]coinbaseinfo[.]email

Analysis of the domain assets.coinbaseinfo.email indicates it was actively involved in a crypto scam impersonating Coinbase, as documented on July 23, 2026. The domain, registered through Dynadot LLC on October 15, 2025, resolved to the IP address 199.59.243.228, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. At the time of assessment, the domain returned an HTTP 200 status but lacked an SSL certificate, a common red flag in phishing operations. The page title, 'coinbaseinfo.email,' aligns with the observed brand impersonation targeting Coinbase, and infrastructure analysis confirms the use of an 'Airdrop Scam' phishing kit.

Security vendor detection on VirusTotal was limited, with 13 of 95 engines flagging the domain, while PhishDestroy had already blocked it. The domain appeared on one security blocklist, and Scamadviser assigned it a trust score of 1 out of 100, further supporting its malicious classification. Nameservers ns1.dyna-ns.net and ns2.dyna-ns.net were associated with the domain, consistent with known phishing infrastructure patterns. As of the report date, the domain has been taken offline, though defenders should remain vigilant for reemergence or similar domains using the same registrar or hosting provider.

While the exact content of the phishing page was not analyzed, the available evidence—including the page title, phishing kit classification, and brand target—strongly suggests a fraudulent scheme designed to deceive Coinbase users. Organizations should monitor for related domains registered through Dynadot or resolving to the same IP range, as threat actors often reuse infrastructure. Blocking the domain at the DNS or proxy level is recommended for proactive defense.