mailbox2-coinbase[.]com

Analysis of mailbox2-coinbase.com indicates that the domain was registered on 2025-10-17 through HOSTINGER operations, UAB and is hosted on Hostinger International Limited infrastructure (ASN 47583) located in Lithuania. The domain resolves to IP 84.32.84.32, which is associated with a Hostinger DNS parking page whose title reads "Parked Domain name on Hostinger DNS system". The page title and the lack of active content suggest the domain is currently parked, and the status flag shows the domain has been taken offline. Despite the inactive state, the domain is listed in at least one security blocklist and has been actively blocked by PhishDestroy.

VirusTotal analysis shows that 11 of 95 security vendors have flagged the domain as malicious, providing independent corroboration of its threat potential. The SSL certificate presented is identified as "R12", indicating a low‑trust certificate. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing the assessment of a high‑risk artifact. The domain is categorized as a crypto‑related scam that impersonates the Coinbase brand.

While the parked page does not expose credential‑capture infrastructure, the combination of brand impersonation, low trust scores, multiple vendor detections, and blocklist presence confirms it as a malicious resource used for social engineering or future exploitation. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the resolved IP 84.32.84.32, and update any threat intelligence feeds with the indicator set (domain, IP, ASN). Because the site is offline, any active phishing payload is not currently observable, but the infrastructure may be reused for other campaigns, so ongoing vigilance is advised.