# helps-coinbase-wallet.pages.dev — MALICIOUS

> The domain helps-coinbase-wallet.pages.dev poses a high phishing risk. Avoid interaction and verify official Coinbase channels for wallet access.

## Summary
PhishDestroy identifies helps-coinbase-wallet.pages.dev as a high-risk brand impersonation threat targeting Coinbase users. This domain was flagged due to its deceptive intent to mimic official Coinbase services.

The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to IP 172.66.44.125. It appeared on multiple security blocklists and was detected by 13 out of 95 VirusTotal security vendors. The site’s title indicated it was a suspected phishing site, reinforcing its malicious nature.

Currently, helps-coinbase-wallet.pages.dev is offline, reducing immediate risk. Users are advised to avoid this domain and always access Coinbase services through verified official websites or apps. PhishDestroy recommends vigilance against similar brand impersonation attempts.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.44.125
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["isabel.ns.cloudflare.com", "jack.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 13 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ca8a8-796f-7702-9937-5150e90c4e73.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/e032de89-1a9d-4a33-aad1-e9d620a0f3ea
- PhishDestroy: https://phishdestroy.io/domain/helps-coinbase-wallet.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/helps-coinbase-wallet.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/helps-coinbase-wallet.pages.dev/
Last updated: 2026-03-19