coinbase[.]now

Analysis indicates that the domain coinbase.now is currently offline but was previously observed resolving to the IPv4 address 199.59.243.228. The address is hosted in the United States and is associated with AS16509, an Amazon.com, Inc. network segment. Registration data shows the domain was provisioned through the BODIS-A registrar, which also uses ASN 16509. No TLS certificate was presented for the host, meaning the site was reachable only over HTTP. The page title returned by the server is exactly “coinbase.now”, matching the domain name and providing no additional context.

The domain is listed on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal records indicate that four out of ninety‑five scanned security vendors flagged the domain as malicious, supporting the classification derived from other intelligence sources. Trust‑rating services assign low credibility scores: Scamadviser rates the site 36 out of 100, and Gridinsoft assigns a score of zero out of 100, both reflecting a high likelihood of abuse. The site is identified as employing a known “Airdrop Scam” phishing kit and is categorized as a crypto‑related scam targeting the Coinbase brand. Given the combination of a brand‑impersonation motif, the presence of a cryptocurrency‑focused phishing kit, low trust scores, and multiple vendor detections, the domain should be treated as high‑risk.

Defensive actions include adding the domain and its resolved IP address to outbound and inbound blocklists, enforcing DNS filtering for the *.now TLD, and monitoring for any re‑registration or resurrection of the host. Analysts should also review related traffic logs for connections to 199.59.243.228 and ensure that any credential‑capture attempts involving Coinbase accounts are investigated. Continuous observation of the registrar BODIS‑A and the Amazon hosting infrastructure is advised, as adversaries may pivot to adjacent assets.