wallet[.]coinbase[.]deal

Analysis of wallet.coinbase.deal shows a confirmed cryptocurrency‑related scam targeting Coinbase users. The domain resolves to IP 199.59.243.228, an address owned by Amazon.com, Inc. (ASN 16509) and geolocated in the United States. Registration details indicate the domain was provisioned through the BODIS‑A registrar, and no SSL certificate was presented at the time of observation, leaving the site accessible only via unencrypted HTTP. The page title returned by the server is "coinbase.deal," matching the domain name and reinforcing the impersonation of the Coinbase brand.

Nameserver queries returned NS_NOT_FOUND, suggesting either a misconfiguration or deliberate obfuscation of resolver information. VirusTotal scans recorded three positive detections out of ninety‑five antivirus engines, confirming malicious behavior. The site was flagged by the PhishDestroy blocklist and appears on one additional security blocklist, indicating that at least two independent threat‑intelligence feeds have identified the domain as malicious. The underlying phishing kit has been catalogued as an "Airdrop Scam," a common vector used to lure victims with promises of free cryptocurrency.

Current operational status is offline, which may be the result of takedown actions or temporary suspension. Defenders should continue to block the domain and the associated IP address across network perimeter defenses, update URL filtering rules, and monitor for any re‑registration attempts or new subdomains using the same hosting ASN. Because the site lacked TLS, any future re‑hosting of the same content would likely continue to be exposed to interception and could be detected through similar HTTP‑only checks. Further investigation is limited by the absence of page content, screenshots, or detailed payload analysis; therefore, continuous scanning of the IP range and periodic re‑evaluation of the domain’s DNS records are recommended to capture any resurgence of activity.