coinbasesupportdesk[.]org

Analysis of coinbasesupportdesk.org indicates a newly registered credential‑harvesting site targeting Coinbase customers. The domain was created on October 16 2025 and is hosted on IP 198.12.80.250, an address assigned to AS36352 HostPapa in the United States. Registrant information shows the domain was purchased through Hostinger Operations, UAB, and the authoritative nameservers are dns1.safedatahost.cloud and dns2.safedatahost.cloud. No TLS certificate is presented, meaning the site is only reachable over HTTP, which facilitates man‑in‑the‑middle inspection and reduces trust signals for browsers and security tools. The page title returned by the web server is “Coinbase Support - Get Help with Your Account,” directly referencing the Coinbase brand and confirming the impersonation claim.

The threat is classified as a crypto‑scam, consistent with the brand target. Reputation data shows the domain appears on a single security blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely low reputation. VirusTotal scans report that 13 of 95 antivirus or URL‑filtering engines label the domain as malicious, reinforcing the suspicion of malicious intent.

Because the site is currently offline, live content cannot be examined, leaving the exact phishing kit or credential‑capture mechanism undetermined. However, the combination of a brand‑spoofing title, lack of encryption, low trust score, multiple vendor detections, and inclusion on a blocklist provides sufficient evidence for defensive teams to treat the domain as hostile. Recommended mitigation steps include adding the IP address 198.12.80.250 and the fully qualified domain name coinbasesupportdesk.org to outbound and inbound block lists, updating URL filtering policies to deny HTTP connections to the domain, and monitoring for any future re‑registration or similar patterns using the same nameserver pair or hosting provider.