coinbase-helpdesk-base[.]com[.]greatbritainfirstcapital[.]com

Analysis indicates that the domain coinbase-helpdesk-base.com.greatbritainfirstcapital.com was registered on 21 February 2026 and is currently taken offline. The sole page title returned by the HTTP server is “Index of /”, suggesting that no application layer content was served before the takedown. The host resolves to IP address 172.245.14.131, which belongs to AS36352 operated by HostPapa in the United States. The IP reputation is poor; the domain appears on one security blocklist and has been explicitly blocked by PhishDestroy.

A Gridinsoft trust score of 0 out of 100 further confirms a lack of legitimacy. The SSL certificate presented is identified as “R12”, a generic or self‑signed certificate commonly observed in fraudulent deployments. VirusTotal scans show that 12 of 93 AV engines flagged the domain, reinforcing the malicious classification. The domain is classified as a crypto‑related scam and is listed as impersonating the Coinbase brand.

No additional evidence such as OTX tags, Safe Browsing status, or registrar details were available. Defenders should add the domain and its IP to blocklists, monitor HostPapa‑owned address space for similar registrations, and enforce outbound filtering for any traffic to the domain or its sub‑domains. Because the site is offline, immediate threat to end users is reduced, but the infrastructure may be reused; continuous observation of the IP and rapid response to any re‑appearance are recommended.