coinbse-help[.]wstd[.]io

Analysis of the domain coinbse-help.wstd.io indicates a high‑risk brand‑impersonation campaign targeting Coinbase. The domain was registered on 21 February 2026 and resolves to the IP address 104.19.163.34, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presents a TLS certificate issued by Let’s Encrypt (CN=E8), confirming the use of a free certificate authority. An HTTP request to the host returns a 401 status code, suggesting that the server is configured to require authentication, but the response does not disclose additional content. The Gridinsoft trust score for the domain is 0 / 100, and it appears on a single security blocklist.

Google Safe Browsing flags the domain for social‑engineering, and PhishDestroy has already taken it offline. VirusTotal reports that 12 of 93 security vendors have flagged the domain as malicious, reinforcing the suspicion of malicious intent. The intelligence explicitly lists Coinbase as the impersonated brand and categorises the activity as brand impersonation. No further details about the page title or underlying phishing kit are available.

The evidence base is limited to infrastructure and reputation signals; the actual payload or credential‑capture mechanism remains unverified. Defenders should block the domain at network perimeter devices, update DNS filtering policies to include the IP 104.19.163.34, and monitor for any future sub‑domains that may be registered under the same parent zone wstd.io. Continuous observation of Cloudflare‑assigned addresses associated with this campaign is recommended, as the attacker may shift hosting while retaining the same certificate authority. Incident response teams should also consider the possibility of credential‑stealing attempts against Coinbase users and advise affected customers to verify login URLs and enable multifactor authentication.