webmail[.]coinbasetransferprocess[.]site

The domain webmail.coinbasetransferprocess.site was observed as an active cryptocurrency‑related impersonation campaign targeting Coinbase users. The site was registered on 18 December 2025 through the DNS Africa registrar and is hosted on a Hetzner Online GmbH server in Germany (AS24940) at IP address 144.76.98.182. No TLS certificate was presented, indicating that the service was delivered over plain HTTP when it was reachable. The public page title returned by the server reads “Roundcube Webmail :: Roundcube Webmailにようこそ”, which does not reference Coinbase but suggests the use of a generic webmail interface as a lure.

VirusTotal scans recorded seven detections out of ninety‑three security vendors, confirming that multiple commercial scanners flagged the domain as malicious. Gridinsoft assigned a trust score of 0 / 100, and the domain appears on at least one external security blocklist, reinforcing the malicious assessment. The nameservers ns01.hkdns.host and ns02.hkdns.host resolve the domain, and the site has been listed by the PhishDestroy takedown service, indicating coordinated mitigation efforts. Current status is offline, but the underlying infrastructure—including the Hetzner IP and the DNS‑Africa registration—remains observable and could be repurposed for future campaigns.

Defenders should continue to block the domain and associated IP address at perimeter filters, monitor for any re‑registration attempts, and consider adding the nameservers to threat‑intel feeds. Because the page title does not contain brand‑specific cues, automated content‑based detection may miss this variant, so reputation‑based controls are recommended. Further analysis is limited by the lack of SSL data and the absence of a live HTTP response, so continued observation of the host and any related subdomains is advised.