cbase-help[.]xyz

This domain, cbase-help.xyz, is confirmed as a high-risk phishing infrastructure impersonating Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site is designed for credential theft, targeting users through brand impersonation tactics. The page title, 'Contact Us,' suggests an attempt to mimic legitimate customer support channels, increasing the likelihood of user engagement under false pretenses. No evidence of a crypto drainer kit was observed, but the domain’s structure and content align with credential harvesting objectives. Infrastructure analysis reveals the domain was registered on December 16, 2025, through OwnRegistrar, Inc., and resolves to the IP address 168.119.43.146, hosted on AS24940 (Hetzner Online GmbH) in Germany. Security vendor assessments on VirusTotal flag the domain as malicious, with 17 out of 95 engines detecting it. Google Safe Browsing has classified the site as phishing, and it appears on at least one security blocklist. The domain lacks an SSL certificate, further reducing its legitimacy and increasing exposure to interception risks. As of the latest assessment, cbase-help.xyz has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the domain’s registration remains active, posing a residual risk of reactivation or repurposing. Users who may have interacted with the site are advised to reset credentials, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.