helps-coinbase[.]com[.]supports-wise[.]com

On July 25, 2026 analysts observed that the domain helps-coinbase.com.supports-wise.com is actively listed as a high‑risk brand‑impersonation site targeting Coinbase users. The domain was registered on 24 October 2023 through Hosting Concepts B.V. d/b/a Registrar.eu and is delegated to the following authoritative name servers: ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu, ns1.cloudoon.com and ns2.cloud. No TLS certificate is presented, indicating that HTTPS connections are unavailable. DNS resolution points to the IPv4 address 15.197.130.221, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States.

Google Safe Browsing classifies the site under social‑engineering, and the domain appears on one external security blocklist. VirusTotal analysis shows that 12 of 95 scanned security vendors flagged the domain, reinforcing the malicious assessment. An independent trust‑score engine (Gridinsoft) assigns a rating of 0 out of 100, and the domain is also blocked by the PhishDestroy feed. The only retrieved HTTP header content is the page title “supports‑wise.com”, which does not reference Coinbase or any legitimate service, and no further page content has been captured.

The combination of brand impersonation, crypto‑scam attribution, lack of encryption, and multiple detections indicates a concerted attempt to lure Coinbase users into fraudulent activity. Defenders should block the domain at perimeter and DNS layers, monitor for outbound connections to the associated IP address, and add the domain to internal phishing and malware blocklists. Ongoing threat‑intel collection should verify whether the infrastructure is reused for additional Coinbase‑related campaigns and whether any compromised credentials have been reported.