help-web-coinbaselogin[.]wstd[.]io

The domain help-web-coinbaselogin.wstd.io was registered on February 25, 2022 through NameCheap, Inc. and currently resolves to the IP address 104.19.164.34, which is hosted by Cloudflare, Inc. (AS13335) in the United States. DNS resolution uses the Cloudflare authoritative nameservers cosmin.ns.cloudflare.com and sandra.ns.cloudflare.com. The site presents the page title "Coinbase Sign In" and is classified as a crypto‑related scam that impersonates the Coinbase brand. A TLS certificate issued by Let’s Encrypt (identifier E8) is in place, but the HTTP response returns a 401 status code, indicating that authentication is required before any content is delivered.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that 13 of 95 scanning engines flag the domain as malicious, and the domain appears on a single security blocklist. PhishDestroy has already taken the site offline, and its current operational status is listed as offline. The available evidence confirms that the infrastructure leverages legitimate cloud services to obscure its origin while delivering a brand‑impersonation page targeting cryptocurrency users.

Uncertainty remains regarding the exact phishing kit or payload delivered after successful credential capture, as no page content has been publicly disclosed. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicator set, and monitor for any resurgence of similar sub‑domains under the wstd.io namespace. Incident response teams should advise users to verify Coinbase URLs through official channels and enforce multi‑factor authentication to mitigate credential reuse risks.