ww25[.]287314-coinbase[.]comww25[.]287314-coinbase[.]com

The domain ww25.287314-coinbase.comww25.287314-coinbase.com was registered on November 09, 2024 through OwnRegistrar, Inc. and currently resolves to IP address 199.59.243.228, which is hosted by Amazon.com, Inc. (AS16509) in the United States. No SSL certificate was observed for the site, indicating that traffic was not encrypted. The infrastructure uses a mixed set of nameservers (a.dnspod.com, c.dnspod.com, ns1.managedns1.com, ns2.managedns1.com, and a null entry), a pattern often associated with fast‑flux or low‑cost hosting services.

The page title returned by the server is "287314-coinbase.com", matching the brand target of Coinbase and confirming the intent to impersonate that financial service. The site employed an Airdrop Scam phishing kit, a common vector for cryptocurrency‑related fraud. Detection telemetry shows that nine of ninety‑five VirusTotal security vendors flagged the domain, and the domain appears on a single blocklist, PhishDestroy, which has already taken it offline.

The lack of an SSL certificate, the use of a reputable cloud provider for hosting, and the presence of a known phishing kit together suggest a deliberate attempt to lure Coinbase users into disclosing credentials or private keys. Defenders should block outbound connections to 199.59.243.228, add the fully qualified domain name to DNS‑based deny lists, and monitor for any email or web traffic referencing the page title or the "287314-coinbase.com" string. Continuous threat‑intel feeds should be consulted for any resurgence of the kit or related domains, and incident response teams should be prepared to handle potential credential theft claims linked to Coinbase users.