webmail[.]coinbase[.]forum

The domain webmail.coinbase.forum was registered on 06 November 2025 through Dynadot LLC and is hosted on the Cloudflare network (AS13335) with the A record 188.114.96.3 located in the United States. The site resolved to a plain‑HTTP service that presented the page title “Roundcube Webmail :: Willkommen bei Roundcube Webmail”. No TLS certificate was observed, indicating that the service was not protected by HTTPS at the time of collection. Reputation checks show a Gridinsoft trust score of 0 / 100 and five of ninety‑five VirusTotal scanners flagged the domain as malicious, confirming its association with hostile activity. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service.

The nameservers alan.ns.cloudflare.com and sierra.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. The infrastructure was attributed to a crypto‑related scam that impersonates the Coinbase brand, as indicated by the “Impersonates: Coinbase” tag and the “Crypto Scam” classification. Current status is offline, suggesting the operators have removed the site after detection. Analysis indicates that the observed indicators – Cloudflare‑hosted IP, lack of TLS, low trust score, flagged status by multiple vendors, and explicit brand impersonation – collectively confirm that webmail.coinbase.forum was employed to lure victims into a cryptocurrency fraud workflow.

The exact tactics, such as credential harvesting or monetary redirection, were not captured in the available data, leaving the detailed payload unknown. Defenders should add the domain, its A record, and the associated nameservers to blocklists, monitor for any re‑registration or similar sub‑domains, and enforce outbound filtering for HTTP traffic to the IP 188.114.96.3. Continuous observation of Cloudflare‑associated abuse reports is recommended, as threat actors frequently recycle infrastructure under the same ASN.