# helpcentercoinbase.com — MALICIOUS

> Avoid helpcentercoinbase.com—a phishing site impersonating Coinbase support. This domain is offline but was flagged for malicious activity.

## Summary
helpcentercoinbase.com was identified as a high-risk phishing domain impersonating Coinbase, aiming to deceive users into divulging sensitive information. The site used a deceptive page title, "Coin base Support - 24/7 Customer Service," to appear legitimate and lure victims. Brand impersonation attacks like this pose significant risks, including identity theft and financial loss.

The domain was registered on February 21, 2026, via Global Domain Group LLC and resolved to IP address 198.251.84.129. It appeared in one AlienVault OTX threat pulse and was listed on three security blocklists. VirusTotal analysis flagged it by 14 out of 95 security vendors. Despite its malicious use, the domain is currently offline, mitigating immediate threat but warranting continued vigilance.

Users should remain cautious and never trust unsolicited support domains resembling official brands. Always verify URLs directly through official channels and avoid clicking links in suspicious emails or messages referencing Coinbase support. Security teams are advised to maintain blocklists and monitor for similar future impersonation attempts to protect users from credential theft.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 0)
- Target brand: Coinbase
- Page title: Coin base Support - 24/7 Customer Service

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Global Domain Group LLC
- Country: US
- IP: 198.251.84.129
- Nameservers: ["ns109.asurahosting.com", "ns109.my-control-panel.com", "ns110.asurahosting.com", "ns110.my-control-panel.com"]
- SSL Issuer: E7

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Lionic", "Seclookup", "SOCRadar", "Sophos", "VIPRE"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce223-b7d1-7018-ab41-ea3ae81f2ec3.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/a235baa1-25fb-494d-b69f-9297bf6f8f49
- PhishDestroy: https://phishdestroy.io/domain/helpcentercoinbase.com/
- LLM endpoint: https://phishdestroy.io/domain/helpcentercoinbase.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/helpcentercoinbase.com/
Last updated: 2026-03-19