coinbase[.]com-access[.]help

This domain, coinbase.com-access.help, poses a high-risk credential harvesting threat by impersonating the legitimate Coinbase cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic Coinbase login portals, tricking users into entering sensitive account credentials, two-factor authentication codes, or wallet recovery phrases. The domain’s infrastructure and naming convention (incorporating "coinbase.com") suggest a deliberate attempt to deceive users into believing they are interacting with the official Coinbase service, increasing the likelihood of successful phishing attacks. Evidence supporting this assessment includes multiple technical indicators. The domain is flagged by 12 out of 95 security vendors on VirusTotal, with Google Safe Browsing specifically marking it as phishing. It appears on one security blocklist and resolves to the IP address 104.21.15.87, hosted on Cloudflare’s network (AS13335). The domain was registered on November 22, 2025, through Web Commerce Communications Limited, and currently lacks an SSL certificate, further reducing its legitimacy. Additionally, the page title "com-access.help | 502: Bad gateway" suggests recent takedown efforts or backend failures, though the domain remains a historical threat. Users who visited coinbase.com-access.help should immediately revoke any entered credentials and enable multi-factor authentication on their Coinbase accounts. If financial transactions or wallet access were attempted, affected users must contact Coinbase support to freeze accounts and review recent activity for unauthorized access. All passwords associated with the compromised email or device should be updated, and endpoint devices should be scanned for malware. Network-level blocking of the domain and its associated IP (104.21.15.87) is recommended to prevent further exposure. Historical logs should be reviewed for connections to this domain to assess potential data exfiltration.