ww25[.]biapayment-coinbase[.]com

Analysis indicates that the domain ww25.biapayment-coinbase.com was created on 12 November 2024 through OwnRegistrar, Inc. The site is currently offline but was previously resolved to the IPv4 address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain employed a set of dnspod.com name servers (a.dnspod.com, b.dnspod.com, c.dnspod.com) together with managedns1.com resolvers (ns1.managedns1.com, ns2.managedns1.com) and an additional placeholder entry “nul”. No TLS certificate was observed, indicating that the service was delivered over plain HTTP.

The page title returned by the server was “biapayment-coinbase.com”, matching the brand target Coinbase and confirming the intended impersonation. The malicious infrastructure was classified as a crypto‑related scam, specifically an Airdrop phishing kit, and the overall trust rating from Gridinsoft was 0 out of 100, reflecting an extremely low reputation. The domain appears on a single security blocklist and was flagged by 12 of 95 antivirus engines on VirusTotal, demonstrating moderate detection across the security ecosystem.

PhishDestroy has already taken the site offline, and the identifier dbbb17 marks the unique seed for this campaign. Defenders should proactively block both the fully qualified domain name and its resolved IP address at perimeter and DNS layers, add the associated name server patterns to threat‑intel feeds, and monitor for future registrations that reuse the same registrar, name server set, or similar “biapayment‑coinbase” naming convention. Continuous telemetry from URL filtering and endpoint detection solutions should be tuned to flag any attempt to reach the domain or its IP, and incident response teams should be prepared to investigate any credential or cryptocurrency wallet disclosures that reference Coinbase‑related airdrop offers.