help-doinbase-feq[.]plasmic[.]run

Analysis of the domain help-doinbase-feq.plasmic.run indicates it was actively involved in a crypto scam impersonating Coinbase, as documented on July 24, 2026. The domain resolved to the IP address 216.150.1.65, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. It was registered through Amazon Registrar, Inc., and utilized nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, suggesting deployment on Vercel's platform. Detected technologies included Node.js, React, Next.js, Webpack, and HSTS, consistent with modern web applications used in phishing operations.

The page title, 'Coinbase® Extension® | Getting Started ~ Wallet,' explicitly targeted Coinbase users, aligning with the scam type classified as a crypto scam. At the time of assessment, the domain returned an HTTP 404 status, indicating it was taken offline. However, prior to its removal, it was flagged by one security blocklist (PhishDestroy) and detected by 9 of 95 security vendors on VirusTotal, confirming its malicious classification. The SSL certificate was issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility.

While the domain is no longer active, defenders should monitor for re-registration or similar domains leveraging the same infrastructure, particularly those using Vercel or Amazon hosting. Historical DNS records and SSL certificate details may assist in identifying related campaigns. No further details about the exact content or distribution methods of the phishing kit are available at this time.