wallet[.]coinbase[.]page

Analysis of wallet.coinbase.page, observed on July 22, 2026, indicates that the domain is being used for a Coinbase brand impersonation campaign classified as a crypto scam. The site resolves to the IP address 199.59.243.228, which is hosted in the United States and attributed to AS16509, Amazon.com, Inc. The registration pathway is listed as BODIS-A (ASN: 16509). No SSL certificate is presented for the domain, and the nameserver query returned NS_NOT_FOUND, suggesting either a misconfiguration or intentional concealment of name service details. The page title returned by the server is "coinbase.page," matching the observed brand target of Coinbase.

VirusTotal records show that three of ninety‑five security vendors have flagged the domain, providing a modest but notable detection signal. The domain appears on a single external security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the conclusion that it is part of an active malicious infrastructure. Gridinsoft’s trust scoring system assigns a rating of zero out of one hundred, reflecting an extremely low reputation. The phishing kit associated with this domain is identified as an "Airdrop Scam," a known tactic that lures victims with promises of free cryptocurrency distributions.

Current operational status is offline, indicating that the site may have been taken down or is otherwise inaccessible at the time of analysis. Despite the offline state, the infrastructure artifacts—host IP, lack of TLS, low trust score, and vendor detections—remain observable and should be treated as indicators of compromise. Defensive recommendations include adding the domain and its resolved IP to inbound and outbound blocklists, monitoring for any future re‑registration attempts, and updating web filtering rules to capture similar brand‑impersonation patterns.