cbkfs-coinbase[.]com

PhishDestroy first observed cbkfs-coinbase.com on Feb 26, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The captured page title is “Checking Connection - Please Wait”. Stored page analysis classifies the content as crypto scam. Current evidence score: 68/100 (high).

Positive findings are stored from 2 sources: VirusTotal and Spamhaus DBL. VirusTotal recorded 6 detections among 93 engines: ADMINUSLabs, ChainPatrol, alphaMountain.ai, CyRadar, Fortinet, Seclookup on Feb 25, 2026 at 00:03 UTC. Spamhaus DBL: DBL_SPAM on Jul 14, 2026 at 02:36 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:16 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:11 UTC; content was unavailable. The recorded creation date for the domain is Feb 21, 2026. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 2a02:4780:45:304:7007:93a6:a2a6:133c on AS47583 (AS-HOSTINGER Hostinger International Limited, CY). The recorded endpoint location is Frankfurt am Main, DE. The stored server header is hcdn. DOM analysis on Mar 23, 2026 at 23:12 UTC returned 63/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists R13 as the certificate issuer.

The content indicators and 2 positive source findings support the current Coinbase-themed crypto scam classification.