mail[.]warranty-coinbase[.]com

The domain mail.warranty-coinbase.com was registered on 21 February 2026 through Dynadot LLC and resolves to the Cloudflare‑owned address 172.67.163.54 (AS13335, United States). The domain is served behind Cloudflare, as indicated by the presence of Cloudflare Browser Insights, the use of HTTP/3, and the nameservers kevin.ns.cloudflare.com and maria.ns.cloudflare.com. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, which is typical for Cloudflare‑proxied sites. An HTTP 403 response was observed, and the site is currently listed as offline.

Threat intelligence flags the domain as a brand‑impersonation campaign targeting Coinbase, specifically categorized as a crypto‑scam. The page title returned from the live host was “Roundcube Webmail :: Welcome to Roundcube Webmail”, suggesting that the underlying service may be a generic webmail interface repurposed for malicious use, although the content has not been publicly examined. The domain appears on a single security blocklist and has been blocked by PhishDestroy. Reputation scoring from Gridinsoft assigned a zero‑point trust score (0/100), indicating extreme malicious confidence.

VirusTotal analysis shows that 12 of 93 scanning engines flagged the domain, reinforcing the perception of risk. Defenders should treat any communications that reference mail.warranty-coinbase.com as hostile, block the domain at perimeter and DNS layers, and monitor for related indicators such as the Cloudflare IP range and the specific SSL fingerprint. Because the site is currently offline, active exploitation cannot be confirmed, but the convergence of brand‑impersonation labeling, low trust score, multiple vendor detections, and the use of a legitimate‑looking webmail title constitute strong evidence of a malicious infrastructure. Ongoing surveillance of the domain’s resolution, certificate changes, and any re‑appearance on blocklists is recommended to maintain situational awareness.