mail[.]ticket-coinbase[.]support

Analysis of the domain mail.ticket-coinbase.support indicates active brand impersonation targeting Coinbase users, classified as a high-risk threat. The domain resolves to IP address 104.21.53.236 and is registered through Cloudflare, Inc. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, alongside a Google Trust Services SSL certificate. The page title, 'Roundcube Webmail :: Willkommen bei Roundcube Webmail,' suggests an attempt to mimic a webmail interface, though the exact content and functionality remain unconfirmed. Security vendor assessments show limited but concerning detection: 10 of 95 vendors flagged the domain on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The presence of an 'Airdrop Scam' phishing kit further supports the classification of this domain as part of a fraudulent campaign. Defenders should treat this domain as malicious, particularly given its association with Coinbase impersonation and the use of Cloudflare infrastructure to obscure origin details. No registration date or additional infrastructure details are available to assess the domain's age or hosting provider beyond the resolving IP. Organizations are advised to block traffic to this domain and monitor for related indicators of compromise.