help[.]coinbasesupports[.]net

The domain help.coinbasesupports.net was registered on February 28, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site is currently offline and has been taken down by Cloudflare, as indicated by the page title "Suspected phishing site | Cloudflare" that appears when the domain is accessed. No TLS certificate is present, confirming that the site operated without HTTPS protection. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme malicious confidence.

VirusTotal analysis shows that 11 of 93 scanning engines flagged the domain, reinforcing the malicious assessment. The nameservers phoenix.ns.cloudflare.com and yahir.ns.cloudflare.com further confirm the use of Cloudflare's DNS infrastructure. The domain is identified as a crypto‑related scam that impersonates Coinbase, matching the brand target provided in the intelligence. While the exact content of the phishing page has not been captured, the combination of registration details, hosting on a Cloudflare IP, lack of SSL, low trust score, blocklist presence, and multiple vendor detections provides strong evidence of a credential‑harvesting or fraud operation aimed at Coinbase users.

Defenders should immediately add help.coinbasesupports.net to deny‑list rules across firewalls, DNS filters, and email gateways. Monitoring of the hosting IP 188.114.97.3 is advised, as the same infrastructure may host additional malicious domains. Continuous watch for new registrations that reuse the "coinbasesupports" pattern or similar Cloudflare‑based nameservers can help pre‑empt future impersonation attempts.