coinbase[.]com-reviews[.]help

This domain is flagged for elevated risk due to brand impersonation targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site mimics legitimate recovery portals to deceive users into disclosing sensitive account credentials or transferring funds under false pretenses. The threat type is classified as brand impersonation with potential secondary risks of credential theft or financial fraud. Infrastructure analysis reveals the domain coinbase.com-reviews.help was registered on January 02, 2026, through Web Commerce Communications Limited. It resolves to IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. VirusTotal reports 16 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently offline. The SSL certificate is issued under the identifier WE1, and the page title observed was 'Case ID | Recovery Portal.' Mitigation steps for this threat type include immediate blocking of the domain and associated IP (188.114.97.3) at the network perimeter. Security teams should monitor for any attempts to access this domain or related infrastructure within internal logs. End-users should be alerted to verify the authenticity of any communication claiming to originate from Coinbase, particularly those directing users to recovery portals or case ID pages. Multi-factor authentication (MFA) should be enforced for all cryptocurrency-related accounts to mitigate the risk of credential theft. Organizations are advised to review historical DNS and proxy logs for connections to this domain or IP to identify potential prior exposure.