webmail[.]oauth-coinbase-support[.]rnx[.]xka[.]mybluehost[.]me

This report details a malicious domain impersonating the Coinbase cryptocurrency brand. The site, webmail.oauth-coinbase-support.rnx.xka.mybluehost.me, was configured to mimic a Coinbase support or webmail portal. The threat posed is a cryptocurrency phishing scam, designed to harvest login credentials and potentially two-factor authentication tokens from Coinbase users by presenting a fraudulent authentication interface.

Technical analysis reveals the domain was created on 2026-02-21. VirusTotal data shows 13 out of 95 security vendors flagged this domain as malicious, including detections from alphaMountain.ai, BitDefender, CRDF, CyRadar, and ESET. The domain is listed on 1 blocklist. The domain risk score is 73 out of 100, indicating a high probability of malicious activity.

The domain is currently DOWN or OFFLINE, which neutralizes the immediate threat of credential harvesting. However, the high risk score and multiple vendor detections confirm its purpose as a malicious impersonation site. The domain remains a potential threat if reactivated.