108909-cb[.]com

The domain 108909-cb.com is identified as a high-risk threat engaging in brand impersonation, specifically targeting the cryptocurrency exchange Coinbase. This domain does not utilize a drainer kit, but its primary intent is to deceive users into providing sensitive information, such as login credentials or personal data.

Infrastructure analysis reveals that 108909-cb.com has been flagged by 19 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. The domain is registered through NiceNIC International Group Co., Limited and resolves to the IPv6 address 2606:4700:3030::6815:acf, which is associated with AS13335 Cloudflare, Inc. in the United States. The domain was created on November 21, 2025, and is currently listed as a phishing site by Google Safe Browsing. Additionally, it appears on 1 security blocklist and is blocked by PhishDestroy. The lack of an SSL certificate further suggests that the domain is not a legitimate Coinbase resource.

As of the latest assessment, the domain 108909-cb.com is offline. Despite this, the risk remains high due to the potential for the domain to be reactivated or used in future attacks. Immediate response actions include monitoring for any signs of reactivation and advising users to avoid interacting with this domain. Organizations should update their security policies to block this domain and educate their users about the dangers of brand impersonation and phishing attacks. The remaining risk is significant, as the domain has already been flagged by multiple security vendors and could be leveraged again for malicious purposes.