# webmail.newscoinbase.com — SUSPICIOUS

> webmail.newscoinbase.com is under phishing investigation. Stay cautious and avoid sharing credentials or clicking suspicious links.

## Summary
PhishDestroy identifies webmail.newscoinbase.com as a domain under active investigation for generic phishing activity. Phishing remains a critical threat vector, where attackers impersonate trusted entities to steal sensitive user data such as login credentials or financial information. This domain's use of a misleading subdomain referencing a well-known brand raises concerns about potential user deception and credential harvesting.

The domain was registered recently on May 17, 2025, through GMO Internet, Inc., a registrar sometimes abused by threat actors for quick domain setups. It resolves to the IP address 102.218.215.37 and currently shows no detections on VirusTotal, indicating it has not yet been flagged by major security vendors. Despite clean scan results, the domain’s infrastructure characteristics and naming conventions suggest it is likely being prepared or used for phishing campaigns, warranting close monitoring.

Users are advised to exercise heightened caution when encountering emails or messages directing them to webmail.newscoinbase.com. Avoid entering any personal or financial information on this site until further verification. Security teams should consider blocking or monitoring this domain proactively and educating users about the risks of phishing attempts exploiting brand impersonation. Reporting suspicious activity related to this domain to cybersecurity authorities can aid in timely mitigation.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP 200)
- Target brand: Coinbase
- Page title: Webmail Login

## Domain Intelligence
- Registered: 2025-05-17 21:14:15
- Registrar: GMO Internet, Inc.
- IP: 102.218.215.37
- Nameservers: ns1.host-ww.net ns2.host-ww.net ns3.host-ww.net ns4.host-ww.net

## Detection Status
- VirusTotal: 4 vendors flagged
  Vendors: ["CRDF", "ChainPatrol", "SOCRadar", "Seclookup"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://i.ibb.co/6JrP5LMt/c06689a3288b.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/df9b9388-d1bc-43d9-a5de-7680d50d741d
- PhishDestroy: https://phishdestroy.io/domain/webmail.newscoinbase.com/

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/webmail.newscoinbase.com/
Last updated: 2026-03-14