mail[.]coinbasegive[.]com

mail.coinbasegive.com is a subdomain of coinbasegive.com. PhishDestroy first observed the hostname on Sep 1, 2026. Stored content metadata identifies Coinbase as the apparent target. Stored page analysis classifies the content as impersonation. Current evidence score: 80/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, MetaMask, SEAL, and Cloudflare Radar. VirusTotal recorded 10 detections among 91 engines: ChainPatrol, BitDefender, ESET, Fortinet, G-Data, Kaspersky, Seclookup, SOCRadar, Sophos, VIPRE on Sep 1, 2026 at 23:27 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Sep 1, 2026 at 22:20 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the malware category; its verdict timestamp was not retained. Non-positive and contextual checks: URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Sep 1, 2026 at 23:28 UTC. URLScan completed without a malicious verdict (score 0) on Sep 1, 2026 at 23:08 UTC.

The collector marked the hostname reachable on Sep 1, 2026 at 20:06 UTC, but did not retain the HTTP response code. Registration records for the registrable domain coinbasegive.com list Sav.com, LLC as the registrar and Oct 19, 2020 as the creation date. At collection time, the hostname resolved to 76.223.54.146 on AS16509 (Amazon.com, Inc.). The recorded endpoint location is Seattle, US. The stored server header is openresty. The evidence archive retains 2 visual captures from PhishDestroy and URLScan; no page title was retained, so the captures preserve the landing-page appearance.

The content indicators and 4 positive source findings support the current Coinbase-themed impersonation classification.