mail[.]coinbases[.]pro

PhishDestroy identifies mail.coinbases.pro as a live brand-impersonation phishing domain targeting Coinbase users. The site mimics Coinbase’s official mail subdomain to harvest login credentials and possibly two-factor codes, putting cryptocurrency holdings at direct risk of theft. This tactic is favored by financially motivated threat actors because even a single successful login can result in irreversible fund loss.

This domain was flagged after showing 2/95 detections on VirusTotal, indicating it remains under the radar of many antivirus engines. Infrastructure analysis reveals a single IP binding (198.54.122.136) and presence on two independent security blocklists, confirming active malicious hosting. The SSL certificate issued by Sectigo Limited adds a veneer of legitimacy, but the domain itself was created recently and is not operated by Coinbase, Inc. Such mismatches between claimed identity and technical provenance are classic red flags for impersonation phishing.

If you visited mail.coinbases.pro, assume your Coinbase credentials may have been exposed. Immediately log in to your Coinbase account via the verified web or mobile app and enable any available security holds. Revoke any unfamiliar API keys or device authorizations in your account settings. Consider rotating passwords and enabling hardware-based two-factor authentication. Report the domain to Coinbase’s abuse team and forward any suspicious emails to Coinbase’s phishing inbox. Monitor your transaction history daily and set up wallet alerts for large outgoing transfers as an additional safeguard.