mail[.]coinbaseservice[.]top

The domain mail.coinbaseservice.top is a phishing site engaged in brand impersonation targeting Coinbase, a well-known cryptocurrency exchange. It poses an elevated risk as a cryptocurrency scam, designed to deceive users into disclosing login credentials or other sensitive information under the false pretense of being an official Coinbase service. No drainer kit was identified in this campaign. The site is currently taken offline, reducing immediate exposure, but prior activity may still pose risks to affected users.

Technical analysis reveals that mail.coinbaseservice.top was flagged by 2 of 95 security vendors on VirusTotal, including Fortinet and SOCRadar. The domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 8.217.95.98, hosted on Alibaba (US) Technology Co., Ltd. infrastructure in Hong Kong. It appears on three security blocklists: PhishDestroy, MetaMask, and SEAL. No SSL certificate was issued, and the observed page title was '404 Not Found'. Nameservers for the domain are ollie.ns.cloudflare.com and viddy.ns.cloudflare.com.

Users who interacted with mail.coinbaseservice.top should immediately change any compromised credentials, particularly for Coinbase or other cryptocurrency-related accounts. Enable two-factor authentication (2FA) to add an extra layer of security. If cryptocurrency transactions were initiated, revoke any suspicious token approvals and consider transferring funds to a new wallet. Report the phishing domain to Coinbase’s security team and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to help prevent further abuse.