help-coinbasepros-cdn[.]tem3[.]io

The domain help-coinbasepros-cdn.tem3.io is identified as a brand impersonation threat targeting Coinbase. No specific drainer kit has been detected. The domain is designed to deceive users into believing they are interacting with the legitimate Coinbase platform.

Infrastructure analysis reveals that the domain was registered through GoDaddy.com, LLC and created on May 06, 2026. It resolves to the IP address 188.114.96.3, which is located in CA and is associated with CloudFlare, Inc. The domain has been flagged by 17 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. Google Safe Browsing has marked this domain as phishing, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services / WE1, which may add a false sense of security to unsuspecting users.

The domain is currently offline, and it has been taken down as part of a coordinated response to mitigate the threat. Despite this, the domain's previous activity and its presence on blocklists suggest that it posed a high risk of brand impersonation. Organizations and individuals should continue to monitor for any resurgence of this domain and ensure that their security measures, such as DNS filtering and user education, are up to date to prevent potential future attacks.