sign-coinbasehelp-com[.]wstd[.]io

Analysis indicates that the domain sign-coinbasehelp-com.wstd.io is currently offline but was previously used as a high‑risk brand‑impersonation site targeting Coinbase users. The site presented the page title "Coinbase.com | Getting started®", which aligns with the reported brand target. The domain was registered on 25 February 2022 via NameCheap, Inc. and resolves to the IPv6 address 2606:4700::6813:a322, hosted by Cloudflare (AS13335, United States). DNS resolution uses the Cloudflare nameservers cosmin.ns.cloudflare.com and sandra.ns.cloudflare.com. The TLS certificate is issued by Let’s Encrypt (E8), indicating a valid, but easily obtainable, certificate.

HTTP requests return a 401 status code, suggesting that the site required authentication before delivering content, though the exact payload is unknown because the site is offline. Reputation data shows that Google Safe Browsing has flagged the domain for social engineering, and VirusTotal recorded 16 detections out of 95 scanned vendors, confirming malicious intent. Gridinsoft assigned a trust score of 0/100, and the domain appears on at least one security blocklist. PhishDestroy has already blocked the domain, and it is listed as a crypto‑related scam in the intelligence feed. The combination of brand impersonation, crypto‑scam classification, and multiple vendor detections places the domain at high risk.

Uncertainties remain regarding the specific phishing page content, any credential‑stealing forms, or additional payloads, as the site is no longer reachable for direct analysis. Defenders should continue to block the domain at perimeter firewalls, DNS resolvers, and proxy filters, monitor for any resurgence of the same hostnames or IP address, and update detection rules to include the observed page title and TLS fingerprint. Incident response teams should also consider flagging any outbound traffic to the Cloudflare IPv6 address as suspicious, especially from users with Coinbase credentials.