coinbasesupporthelp[.]nettlis[.]sbs

Analysis indicates that the domain coinbasesupporthelp.nettlis.sbs was registered on 21 February 2026 and immediately began serving a page titled “Coinbase Support”. The page title aligns with the declared brand target of Coinbase, confirming a brand‑impersonation intent. Network resolution points to the IP address 86.107.77.210, which is allocated to HostBet Cloud Technologies Private Limited in Germany under ASN 216395.

The hosting provider is associated with multiple abuse reports, and the IP appears on three independent security blocklists. The domain’s SSL certificate is identified as “R12”, suggesting a low‑trust or self‑signed certificate, and the Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. VirusTotal scans have recorded detections by 12 of 93 security vendors, and the domain is listed by PhishDestroy, MetaMask, and SEAL as a known phishing or crypto‑draining site.

The overall risk rating is high, and the infrastructure has been taken offline at the time of writing, although the removal does not eliminate the threat to users who may have previously accessed the site. Defenders should continue to block the domain and its associated IP at perimeter and endpoint controls, monitor for any re‑hosting attempts, and advise users to verify URLs against official Coinbase channels. Ongoing telemetry should be collected to detect potential reuse of the hosting infrastructure for new impersonation campaigns.