coinbase-mailbox[.]com

This domain, coinbase-mailbox.com, is flagged as an active brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain is designed to mimic legitimate Coinbase communications, likely to facilitate credential theft or unauthorized account access. No crypto drainer kit signatures were observed in initial scans, but the domain’s structure and naming convention align with known brand impersonation tactics. Infrastructure analysis reveals the following technical indicators: the domain was registered on October 13, 2025, through HOSTINGER operations, UAB, and resolves to the IP address 84.32.84.32, hosted on AS47583 (Hostinger International Limited, Lithuania). VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. No SSL certificate is present, and the page title reads "Parked Domain name on Hostinger DNS system," suggesting limited operational activity at this stage. Current status indicates the domain remains active but lacks fully deployed malicious infrastructure. Response actions should include monitoring for changes in hosting behavior, such as SSL certificate issuance or content updates, which may signal imminent malicious activity. The elevated risk level persists due to the domain’s association with a high-value brand and its presence on multiple security vendor blocklists. Organizations are advised to block the domain at the network level and alert users to potential credential theft attempts originating from this infrastructure.