imap[.]lombard4u[.]ru

Analysis of the domain imap.lombard4u.ru indicates it is actively impersonating Coinbase as part of a credential phishing operation. The domain was registered on February 21, 2026, through REGRU-RU and resolves to IP address 5.181.109.68, hosted on AS198610 (Beget LLC) in Russia. The SSL certificate is issued by Let's Encrypt (R13), and the infrastructure employs RoundCube Webmail, PHP, Nginx, and frontend libraries such as Bootstrap and jQuery. The page title, 'Roundcube Webmail :: Welkom bij Roundcube Webmail,' suggests an attempt to mimic a legitimate webmail interface, though the exact content and targeting mechanisms remain unconfirmed. The domain is flagged by 8 of 93 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. HTTP status returns 200, confirming the site is currently active. Nameservers are hosted under beget.com and beget.pro, consistent with the hosting provider's infrastructure. While the domain is explicitly linked to Coinbase impersonation in threat intelligence sources, no further details about the phishing kit's functionality or post-compromise behavior are available at this time. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it. The use of RoundCube as a frontend may indicate an attempt to harvest email or cryptocurrency exchange credentials. Given the domain's recent registration and active status, further infrastructure or campaign linkages may emerge. No evidence currently suggests this is part of a broader or previously documented phishing cluster.