mail[.]coinbase-accountrecover[.]com

The domain mail.coinbase-accountrecover.com is currently active and has been identified as a high‑risk brand‑impersonation site targeting Coinbase users. The page title returned by the server is "Coinbase Wallet," indicating a direct reference to the Coinbase brand. Google Safe Browsing classifies the domain under the SOCIAL_ENGINEERING category, and VirusTotal reports that 14 out of 95 security vendors flag the domain as malicious. The site is listed on one public security blocklist and is actively blocked by the PhishDestroy service. Infrastructure analysis shows the domain resolves to the IPv6 address 2606:4700:3030::6815:2001, which is owned by AS13335 Cloudflare, Inc., located in the United States. The domain is served through Cloudflare's network, employing HTTP/3, and presents a TLS certificate issued by Google Trust Services under the WE1 designation. Nameservers peaches.ns.cloudflare.com and salvador.ns.cloudflare.com further confirm Cloudflare as the authoritative DNS provider. The domain was registered on September 12, 2025 via OwnRegistrar, Inc., and the HTTP response code is 521, indicating that the origin server is currently unavailable. The scam type is identified as cryptocurrency, aligning with the Coinbase brand impersonation. While the page title suggests a focus on Coinbase Wallet, no additional content has been publicly analysed, leaving the exact payload and credential‑collection mechanisms uncertain. Defenders should incorporate the domain into URL filtering rules, enforce DNS sink‑holing for the associated IPv6 address, and monitor for any related traffic to the Cloudflare edge nodes. Continuous observation of the domain's registration status and any changes to its SSL certificate or hosting configuration is advised to detect potential evolution of the threat.