wallet-help-coinbase[.]com

The domain wallet-help-coinbase.com is a confirmed phishing site engaged in brand impersonation targeting Coinbase, a major cryptocurrency exchange. It presents itself as a legitimate Coinbase platform to deceive users into disclosing login credentials or sensitive information, posing an elevated risk as a cryptocurrency scam. No drainer kit was identified, and the site is currently taken offline, though prior activity remains a concern for potential victims.

Technical analysis reveals wallet-help-coinbase.com was flagged by 10 of 95 VirusTotal security vendors, including ChainPatrol, alphaMountain.ai, and BitDefender. The domain appears on one security blocklist, PhishDestroy, and was created on February 21, 2026. It resolved to the IP address 150.40.121.24, hosted by AS211619 MAXKO d.o.o. in Croatia, with an SSL certificate issued by E8. The observed page title, 'Coinbase: The Most Trusted Place To Buy, Sell & Use Crypto,' closely mimics the legitimate Coinbase branding to enhance credibility.

Users who interacted with wallet-help-coinbase.com should immediately change their Coinbase passwords and enable two-factor authentication (2FA) to secure accounts. Monitor for unauthorized transactions or login attempts and report any suspicious activity to Coinbase support. Victims are advised to report the phishing domain to Google Safe Browsing, their local cybercrime unit, and platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in mitigation efforts.