admin[.]coinbasew[.]mobi

admin.coinbasew.mobi is currently flagged as a brand impersonation site targeting Coinbase. The domain was registered on March 10, 2026 through Gname.com Pte. Ltd. and resolves to the IP address 134.122.152.231, which belongs to AS152194 (CTG Server Limited) in Singapore. The hosting server presents an Nginx front‑end with HTTP/3 support and serves content built on Vue.js, while HSTS is enforced. The site presents a TLS certificate issued by Let’s Encrypt (R12), confirming that encryption is in place despite the malicious intent.

Google Safe Browsing classifies the domain as social engineering, and the page title returned from the host is the Chinese phrase “后台管理系统” (Backend Management System), which does not directly reference Coinbase but aligns with a generic administrative interface. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. A VirusTotal scan shows that four of ninety‑five antivirus engines flagged the site, indicating a modest but non‑trivial detection rate. Gridinsoft’s trust score is 0 out of 100, reinforcing the malicious assessment.

The overall risk is elevated, and the site is presently offline, suggesting that the operators may have withdrawn the payload or are preparing a new deployment. Defenders should continue to monitor the IP address 134.122.152.231 for any re‑activation, enforce domain‑level blocking for admin.coinbasew.mobi across email gateways and web filters, and add the domain to internal watchlists. Because the page title and content are not publicly disclosed, further forensic analysis of the underlying HTML, JavaScript, and any credential‑capture endpoints would be required to fully characterize the attack vector. Until the site reappears, maintaining the current blocklist entries and ensuring that users are educated about unsolicited Coinbase‑related communications remain the primary mitigations.