coinbase[.]dolw[.]com

coinbase.dolw.com is a malicious sub‑domain that masquerades as Coinbase, as indicated by the brand target field. The site was associated with an Airdrop Scam phishing kit, a known crypto‑scam vector that typically lures victims with promises of free token drops. DNS resolution points to 199.59.243.228, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The hosting provider is therefore Amazon Web Services, which is a common infrastructure choice for disposable phishing sites. No SSL certificate is presented, meaning the site served traffic over plain HTTP, a characteristic often observed in quickly deployed scams.

The HTTP response is currently offline, preventing live content inspection, and the page title returned by the server is “dolw.com”, which does not reveal any Coinbase branding. The domain was registered on 26 May 2001 through Alibaba Cloud Computing (Beijing) Co., Ltd., and it uses the DNSPod nameservers f1g1ns1.dnspod.net and f1g1ns2.dnspod.net. Reputation data shows the domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal reports 15 of 95 scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. Gridinsoft assigns a trust score of 0 / 100, indicating a complete lack of confidence in the host.

The combination of a known phishing kit, a low trust score, multiple vendor detections, and blocklist listings provides strong evidence that the domain is being used for crypto‑related fraud targeting Coinbase users. Uncertainty remains regarding the exact payload delivered when the site was active, as the offline status precludes direct observation of the landing page or any credential‑harvesting forms.