help-coinbasehelp-com[.]wstd[.]io

Analysis shows that the domain help-coinbasehelp-com.wstd.io was created on February 25, 2022 and registered through NameCheap, Inc. The site presents a Let’s Encrypt (E8) SSL certificate, indicating encrypted HTTPS support, yet HTTP requests receive a 401 status code, suggesting restricted or removed content. DNS resolution points to IP address 104.19.164.34, which belongs to Cloudflare, AS13335, and is geolocated in the United States. The domain is classified as a crypto scam and explicitly impersonates the Coinbase brand. Google Safe Browsing flags the URL for social engineering, and 13 of 95 VirusTotal scanners have raised detections against the domain.

The Gridinsoft trust score is 0 out of 100, reinforcing a malicious assessment. The domain appears on one external security blocklist and is listed as blocked by PhishDestroy. Nameserver delegation to cosmin.ns.cloudflare.com and sandra.ns.cloudflare.com confirms the use of Cloudflare’s DNS infrastructure.

Current status is offline, with no active web content observable, leaving the exact phishing page layout or credential‑harvesting mechanisms unverified. Defenders should immediately block the fully qualified domain name and its associated IP at perimeter firewalls and DNS resolvers, apply sinkholing where feasible, and incorporate the domain into internal threat‑intel feeds. Continuous monitoring of Cloudflare‑hosted subdomains that share the same nameserver pattern is advised, as adversaries often reuse this infrastructure for new impersonation campaigns targeting the same brand.