# ww25.agent-help-coinbase.com — MALICIOUS

> Stay alert: ww25.agent-help-coinbase.com impersonates Coinbase. Avoid this high-risk site and verify URLs before sharing sensitive info.

## Summary
PhishDestroy identifies ww25.agent-help-coinbase.com as a brand impersonation threat targeting Coinbase users. Classified as a high-risk phishing domain, it attempts to deceive victims by mimicking official Coinbase branding and page titles such as "agent-help-coinbase.com" to gain user trust.

This suspicious domain was registered on January 16, 2025, through OwnRegistrar, Inc. It resolves to IP address 199.59.243.228 and has been listed on two separate security blocklists. VirusTotal analysis shows that 17 out of 95 security vendors have flagged this domain, highlighting its malicious intent within cybersecurity communities.

Currently, ww25.agent-help-coinbase.com has been taken offline, disrupting its phishing operations. Users are advised to remain vigilant against similar deceptive URLs and always verify web addresses when accessing Coinbase services. PhishDestroy continues to monitor such threats to help protect the community from fraud and identity theft.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: agent-help-coinbase.com

## Domain Intelligence
- Registered: 2025-01-16 00:08:27
- Expires: 2027-01-16 00:00:00
- Registrar: OwnRegistrar, Inc.
- Country: UNITED STATES
- IP: 199.59.243.228
- IP Org: Cloudflare CDN
- Nameservers: ["devin.ns.cloudflare.com", "tia.ns.cloudflare.com"]
- SSL Issuer: none

## Detection Status
- VirusTotal: 17 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "BitDefender", "CRDF", "CyRadar", "ESET", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Seclookup", "SOCRadar", "Sophos", "Trustwave", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://i.ibb.co/wh6YxhXX/4bd0e8823803.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/9c90a51d-326f-47f4-b34f-03277c2ccdf7
- PhishDestroy: https://phishdestroy.io/domain/ww25.agent-help-coinbase.com/
- LLM endpoint: https://phishdestroy.io/domain/ww25.agent-help-coinbase.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/ww25.agent-help-coinbase.com/
Last updated: 2026-03-19