ww25[.]mailsrv[.]coinbaserestore[.]com

Analysis of the domain ww25.mailsrv.coinbaserestore.com indicates it was actively impersonating Coinbase as part of an airdrop-themed cryptocurrency scam. The domain was registered on November 8, 2024, through OwnRegistrar, Inc., and resolved to the IP address 199.59.243.228, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. No SSL certificate was detected, increasing the likelihood of unencrypted credential harvesting. The page title, 'coinbaserestore.com,' directly references the targeted brand, reinforcing the impersonation attempt.

Infrastructure analysis reveals the domain used nameservers coco.bunny.net, kiki.bunny.net, ns1.managedns1.com, ns2.managedns1.com, and null, suggesting a mix of bulletproof and consumer-grade DNS providers. The domain appeared on one security blocklist and was flagged by 12 of 95 security vendors on VirusTotal, confirming detection by multiple threat intelligence sources. Gridinsoft assigned a trust score of 0/100, further validating its malicious classification. The domain was taken offline following intervention by PhishDestroy, though residual DNS or cached records may persist.

Defenders should treat this domain as a confirmed phishing endpoint targeting Coinbase users, likely distributing fraudulent airdrop offers to steal cryptocurrency credentials or wallet access. Historical resolution to 199.59.243.228 should be blocked at the network level, and any associated subdomains or redirect chains should be investigated. The absence of an SSL certificate and use of a recently registered domain align with common phishing tactics, though the exact content of the site remains unanalyzed. Monitoring for similar domains using the same registrar or DNS providers is recommended.