helps-coinbshelp-docs[.]netlify[.]app

The domain helps-coinbshelp-docs.netlify.app, now offline, impersonates Coinbase to deceive users into providing sensitive information. It was flagged as malicious by 10 out of 95 vendors on VirusTotal, indicating a significant threat level. The site aimed to mimic the Coinbase help page, leveraging the trust users have in the brand to execute a cryptocurrency scam.

PhishDestroy detected this phishing domain on October 9, 2025, highlighting its rapid identification capabilities. The domain was registered through Netlify and hosted on an IP address associated with Amazon.com, Inc. in Germany. Despite its offline status, the initial detection and takedown demonstrate the effectiveness of coordinated cybersecurity efforts.

The abuse score of 20/100 suggests a moderate risk, but the presence on a public blocklist, specifically PhishDestroy's, underscores the importance of awareness and proactive measures. The site used a DigiCert SSL certificate, a common tactic to lend legitimacy to fraudulent operations. Such phishing domains exploit the gap between registration and detection by antivirus vendors, emphasizing the need for upstream threat intelligence solutions.