mail[.]advisor-coinbase[.]support

This domain, mail.advisor-coinbase.support, is flagged as an active high-risk phishing operation targeting Coinbase users through an airdrop scam framework. Analysis indicates the page presents itself as a Roundcube Webmail interface, as evidenced by the page title 'Roundcube Webmail :: Welcome to Roundcube Webmail.' While the exact content of the page remains unconfirmed beyond this title, the presence of a known phishing kit labeled 'Airdrop Scam' suggests the site is designed to deceive users into believing they are interacting with a legitimate cryptocurrency reward or giveaway, likely tied to Coinbase branding. Infrastructure analysis reveals the domain resolves to the IP address 172.67.175.222 and is protected by Cloudflare, a common tactic to obscure hosting origins and evade takedown efforts. The domain is registered through Cloudflare, Inc., and employs an SSL certificate issued by Google Trust Services, which may lend a superficial appearance of legitimacy. However, detection by 12 out of 95 security vendors on VirusTotal, alongside its presence on at least one security blocklist, confirms malicious classification. The use of HTTP/3 and Cloudflare Browser Insights further aligns with modern phishing infrastructure designed for performance and resilience. What remains uncertain is the precise mechanism of the scam, as the page content beyond the Roundcube Webmail title has not been fully analyzed. Defenders should treat this domain as an active threat, particularly for users of the targeted brand. Network-level blocking of the domain and its resolving IP is recommended, along with monitoring for related subdomains or newly registered lookalike domains. Given the high-risk designation and confirmed phishing kit, organizations should prioritize user education to recognize airdrop scams and verify communications through official channels only. The domain’s continued activity as of July 12, 2026, underscores the need for immediate mitigation.