myhelp-coinbase[.]com

This domain, myhelp-coinbase.com, is identified as a high-risk brand impersonation phishing site targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing it is an official Coinbase support or service portal, potentially facilitating credential harvesting or unauthorized transactions. No specific drainer kit signatures were observed in initial scans, but the domain structure and naming convention strongly suggest intent to exploit trust in the Coinbase brand for malicious purposes.

Technical indicators reveal the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 104.18.35.15, which is part of a content delivery network (CDN) infrastructure commonly abused to obfuscate malicious activity. VirusTotal detection metrics show 12 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists, including MetaMask, SEAL, and PhishDestroy, and was previously blocked by Google Safe Browsing (GSB) prior to being taken offline. The page title 'Just a moment...' is consistent with intermediate loading pages used to filter or redirect victims to final phishing payloads.

As of the latest assessment, myhelp-coinbase.com has been taken offline, likely due to hosting provider or registrar enforcement actions. However, residual risk remains due to the domain's recent creation date and the potential for infrastructure reuse. Users who accessed the domain prior to its takedown should assume credential exposure and initiate password resets, multi-factor authentication reviews, and transaction history audits on their Coinbase accounts. Organizations are advised to update blocklists with this domain and its associated IP, monitor for related domains using similar naming patterns (e.g., 'help-coinbase', 'support-coinbase'), and conduct retrospective log analysis for any interactions with 104.18.35.15 or the registrar's network range.