smtp[.]coinbaseregion[.]com

The domain smtp.coinbaseregion.com is a phishing site engaged in brand impersonation targeting Coinbase users. It poses an elevated risk as a cryptocurrency scam designed to deceive victims into disclosing login credentials or sensitive account information. No drainer kit was identified, and the site is currently taken offline, though prior activity may still pose a threat to those who interacted with it.

Technical analysis shows smtp.coinbaseregion.com was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appears on 1 security blocklist (PhishDestroy). The domain was registered through Cosmotown, Inc. on October 30, 2025, and resolves to the IP address 198.251.89.205, hosted by FranTech Solutions (AS53667) in the US. Its SSL certificate was issued by Let's Encrypt (E8), and the domain uses nameservers ns111.asurahosting.com, ns111.my-control-panel.com, ns112.asurahosting.com, and ns112.m. The observed HTTP status was 526, and Gridinsoft assigned a trust score of 0/100. Google Safe Browsing did not flag the domain at the time of assessment.

Individuals who visited smtp.coinbaseregion.com should immediately change their Coinbase passwords and enable two-factor authentication if they entered credentials. Monitor accounts for unauthorized transactions or suspicious activity. Users of cryptocurrency wallets should review and revoke any token approvals granted during the suspected exposure period. Report the phishing domain to Coinbase’s security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.