coinbaseblockchainhelpdesk[.]com

coinbaseblockchainhelpdesk.com is an active domain that mimics the Coinbase brand. The site presents a generic page title “Home | My Site” and has been classified as a high‑risk cryptocurrency impersonation. The domain was registered on 27 October 2025 through a Wix‑provided registrar and currently resolves to the Google Cloud IP address 34.149.87.45. Infrastructure analysis shows the domain uses Wix’s DNS service (ns4.wixdns.net, ns5.wixdns.net) and is hosted on Google Cloud infrastructure (AS396982, United States). The site is served over HTTPS with a Let’s Encrypt R12 certificate and enforces HSTS. Detected front‑end components include Wix, UIKit, React, Lodash, Google Cloud CDN and Google Analytics, indicating a standard Wix‑based web‑stack rather than a specialized phishing kit. Threat intelligence indicates that 13 of 95 VirusTotal scanners have flagged the domain, and Gridinsoft assigns a trust score of 1 / 100. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. HTTP responses return a 301 redirect, but the final landing content beyond the title has not been publicly disclosed, leaving the exact credential‑harvesting mechanism uncertain. No additional indicators such as malicious payloads or observed victim reports have been documented. Defenders should treat coinbaseblockchainhelpdesk.com as a malicious actor targeting Coinbase customers. Recommended actions include adding the domain to network and endpoint blocklists, monitoring DNS queries for the associated Wix name servers, and enforcing TLS inspection to capture any hidden payloads. Continuous observation of traffic to the IP 34.149.87.45 and periodic re‑scans with updated threat services are advised to detect any evolution in the site’s behavior.