584c6624-7531-4d50-b8f3-64f7e15cc1c5[.]team-coinbase[.]help

The domain 584c6624-7531-4d50-b8f3-64f7e15cc1c5.team-coinbase.help is identified as an elevated-risk brand impersonation threat targeting Coinbase users. Analysis confirms this infrastructure was designed to harvest login credentials, two-factor authentication codes, and sensitive financial data by mimicking the legitimate Coinbase platform. The domain is currently offline, though prior activity suggests it was operational in active phishing campaigns prior to takedown. Infrastructure analysis reveals the domain was flagged by 11 of 95 security vendors on VirusTotal, indicating moderate to high detection rates among endpoint protection systems. The domain appears on one security blocklist, further corroborating its malicious classification. Registration records show the domain was created on February 21, 2026, suggesting a short-lived but targeted operation. No associated IP addresses or hosting providers were publicly archived in threat intelligence feeds at the time of analysis, though historical DNS resolutions may exist in private datasets. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the risk remains elevated for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access to Coinbase accounts, particularly those linked to email addresses or devices used during the domain's active period. Security teams should review logs for connections to 584c6624-7531-4d50-b8f3-64f7e15cc1c5.team-coinbase.help and implement additional authentication controls for affected accounts. Users who entered credentials on this domain should assume compromise and rotate passwords immediately, while enabling multi-factor authentication on all financial platforms. Proactive threat hunting for related domains using the same UUID pattern (584c6624-7531-4d50-b8f3-64f7e15cc1c5) is recommended to identify potential follow-up campaigns.