webmail[.]coinbasecommerceesupport[.]com

The domain webmail.coinbasecommerceesupport.com was registered on October 18, 2025 and is currently flagged as an offline Coinbase impersonation site used for crypto‑related scams. Infrastructure analysis shows the domain is hosted behind Cloudflare, using the nameservers charles.ns.cloudflare.com and monroe.ns.cloudflare.com, and resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming the use of a legitimate certificate authority but offering no guarantee of legitimacy of the content. HTTP requests return a 403 status code and the page title displayed is "Account Suspended," indicating that the site has been taken down or is intentionally presenting a suspension notice.

VirusTotal scans have recorded 13 detections out of 95 security vendors, providing moderate confidence that the domain is malicious. It is listed on at least one external security blocklist and has been actively blocked by the PhishDestroy service. The registrar listed is OwnRegistrar, Inc., and the site advertises itself as a crypto scam targeting Coinbase users.

While the current offline status limits immediate threat exposure, defenders should continue to monitor the domain for potential re‑activation, enforce blocklist rules for the associated IP and hostnames, and incorporate the detection count from VirusTotal into automated threat‑intel feeds. Organizations using Coinbase services should educate users about the existence of this impersonation vector and advise them to verify URLs carefully, especially when encountering unexpected account‑suspension messages. Evidence from the known intelligence—including the domain creation date, hosting details, SSL issuer, HTTP response, and vendor detections—supports the classification of this domain as a high‑risk brand‑impersonation asset.