demo[.]team-coinbase[.]help

Analysis of demo.team-coinbase.help indicates that the domain was registered on January 22, 2025 through Dynadot LLC and uses the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. The public DNS resolves to the IPv4 address 75.2.115.196, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. No TLS certificate was observed for the host, meaning the site was served over plain HTTP. The page title reported by the intelligence feed is “team‑coinbase.help”, and the domain is explicitly associated with a Coinbase brand impersonation campaign classified as a crypto scam. VirusTotal recorded 13 detections out of 95 scanned vendors, and the domain appears on a single security blocklist.

PhishDestroy has also listed the domain as blocked. As of the report date, July 23, 2026, the site is taken offline, which is reflected by its current status flag. The evidence does not include any captured content, login forms, or additional infrastructure such as command‑and‑control endpoints, so the precise payload or victim interaction mechanisms remain unknown. Defenders should treat the domain as malicious and incorporate the IPv4 address and the domain name into perimeter denial lists and DNS sinkhole configurations.

Monitoring for future activity from the same IP range or from other domains registered with Dynadot using the same nameserver pair is advisable, as the infrastructure may be reused in subsequent campaigns. Because the certificate is absent, any future activation of the domain will likely continue to operate without HTTPS, providing an additional indicator for detection. Organizations should also ensure that endpoint protection and web filtering solutions reference the latest blocklist entries from PhishDestroy and VirusTotal to capture the 13 vendor detections. Continuous threat‑intel correlation with other Coinbase‑related impersonation attempts can help identify broader campaign patterns.