webmail[.]advisor-coinbase[.]support

The domain webmail.advisor-coinbase.support is flagged as an active, high‑risk brand‑impersonation site targeting Coinbase users. HTTP analysis returns a 200 status code, and the page title observed is "Roundcube Webmail :: Willkommen bei Roundcube Webmail," indicating the use of a generic Roundcube interface. The site is listed as employing an Airdrop Scam phishing kit, aligning with the reported cryptocurrency scam type, and it explicitly claims to impersonate Coinbase.

Infrastructure profiling shows the domain is registered through Cloudflare, Inc., and resolves to the IP address 172.67.175.222, which belongs to AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the identifier WE1, and the service is delivering content over HTTP/3, confirming modern protocol adoption. No additional hosting or CDN layers were identified beyond the primary Cloudflare presence.

Threat intelligence sources indicate that the domain has been blocked by PhishDestroy and appears on a single security blocklist. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence. VirusTotal analysis shows that 2 out of 95 security vendors have flagged the domain, providing limited but corroborating evidence of malicious activity. The combination of a low trust score, blocklist presence, and vendor flags supports the high‑risk classification.

Defenders should prioritize immediate network-level blocking of webmail.advisor-coinbase.support and monitor outbound DNS queries for the associated IP address 172.67.175.222. Email security gateways should be tuned to detect references to Coinbase within suspicious content, and user awareness training should emphasize the risk of unsolicited cryptocurrency airdrop offers. Continuous monitoring of VirusTotal and related threat feeds is recommended to capture any changes in vendor detection rates or additional blocklist listings.