mail[.]coinbasebank[.]org

Analysis shows that mail.coinbasebank.org is an offline domain that was used for brand impersonation of Coinbase in a crypto‑scam campaign. The domain resolves to IP 66.96.162.147, which belongs to AS29873 Newfold Digital, Inc. and is geolocated in the United States. The SSL certificate presented by the host is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 chain, a common commercial certificate that does not guarantee legitimacy. Registration data indicates the domain was created on March 21 2021 and was registered through Domain.com – Network Solutions, LLC, using the generic nameservers ns1.domain.com and ns2.domain.com.

VirusTotal scans recorded nine detections out of ninety‑five vendors, and Gridinsoft assigned a trust score of zero out of one hundred, both pointing to malicious intent. The site returned a HTTP 403 Forbidden title, consistent with a takedown or block, and it is listed on one security blocklist. PhishDestroy has confirmed the domain is blocked. While the precise content of the site before removal is not available, the available intelligence classifies the threat as a crypto scam that attempts to lure victims by masquerading as Coinbase communications.

Uncertainty remains regarding any payloads, credential‑harvesting pages, or additional infrastructure that may have been shared with other campaigns. Defenders should proactively block the IP address 66.96.162.147 at network perimeter devices, add the domain to email and web filtering allow‑lists for quarantine, and monitor for re‑use of the same registrar, nameserver pattern, or SSL issuer in newly observed domains. Continuous observation of VirusTotal, threat‑intel feeds, and any emerging blocklist entries is recommended to catch resurgence attempts. Updating brand‑monitoring signatures to include variations of "coinbasebank.org" will improve early detection of similar impersonation attempts.