nwkpykccvfzubbl[.]wwcoinbase[.]com

Analysis of the domain nwkpykccvfzubbl.wwcoinbase.com indicates it is a confirmed brand impersonation site targeting Binance, classified as a crypto scam. The domain was registered on March 15, 2025, through GoDaddy.com, LLC, and is currently offline. Infrastructure analysis reveals the site was hosted behind Cloudflare, with nameservers derek.ns.cloudflare.com and imani.ns.cloudflare.com, resolving to IP 99.84.152.89, located in Germany under AS16509 (Amazon.com, Inc.). The SSL certificate was issued by Google Trust Services (WE1), a common but not inherently malicious provider.

Detection data shows the domain appears on one security blocklist (PhishDestroy) and was flagged by 10 of 95 security vendors on VirusTotal, confirming elevated risk. The page title, 'Create a free account | Binance,' directly aligns with the reported scam type, reinforcing its intent to deceive users into believing it is an official Binance registration page. No evidence suggests the domain was ever legitimate, and its structure—using a subdomain under wwcoinbase.com—attempts to exploit unrelated branding to appear credible. Defenders should treat this domain as malicious and prioritize blocking it at DNS, proxy, and endpoint levels.

The combination of Cloudflare hosting, Amazon IP space, and GoDaddy registration is consistent with phishing infrastructure but not conclusive alone; the detection counts and blocklist presence provide stronger indicators. Since the domain is offline, monitoring for re-registration or similar subdomain patterns under wwcoinbase.com is recommended. No further content analysis is available, so assumptions about specific phishing techniques (e.g., credential harvesting, wallet drainers) cannot be made without additional evidence.