webmail[.]desk-coinbase[.]com

This domain, webmail.desk-coinbase.com, is identified as a high-risk brand impersonation resource targeting Coinbase users. Analysis indicates the infrastructure was designed to mimic the official Coinbase webmail interface, likely to harvest credentials or distribute malicious payloads. The threat type aligns with credential phishing, a common vector for unauthorized account access in cryptocurrency platforms. Infrastructure analysis reveals the domain was registered on March 14, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to the IP address 104.21.84.114, which is associated with Cloudflare services, and employs HTTP/3 and a Let's Encrypt SSL certificate to present a veneer of legitimacy. The domain appears on three security blocklists and is flagged by 15 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. Additional detection sources include MetaMask, PhishDestroy, and SEAL, further corroborating its malicious classification. At present, the domain returns a 521 error indicating the web server is offline, suggesting takedown or voluntary suspension. While the immediate threat has been mitigated, residual risk persists due to potential DNS cache retention or re-registration under alternative names. Users are advised to verify domain authenticity through official channels, monitor account activity for unauthorized access, and employ multi-factor authentication to mitigate credential-based attacks. Organizations should update blocklists to include this domain and its associated IP to prevent future exposure.