admin[.]coinbasesabms[.]cc

admin.coinbasesabms.cc was observed as a high‑risk brand‑impersonation site targeting Coinbase. The domain was registered on 2025-11-11 through Dynadot LLC and resolves to the Cloudflare address 172.67.152.141, which is associated with AS13335 in the United States. No TLS certificate is presented, indicating the site operates without HTTPS. The authoritative name servers are alberto.ns.cloudflare.com and opal.ns.cloudflare.com.

Reputation services assign extremely low scores: Gridinsoft 0/100 and Scamadviser 1/100, reinforcing the malicious assessment. VirusTotal reports that 15 of 95 scanned security vendors flagged the domain, and the site appears on one external blocklist. Google Safe Browsing lists it as a social‑engineering threat, and PhishDestroy has already blocked the domain. The only visible page title returned during a brief HTTP request is “BITKUB - 币盘后台管理系统”, which suggests a backend management interface unrelated to Coinbase.

The domain is currently offline, but historical evidence indicates it was used for a crypto‑scam campaign impersonating Coinbase. Uncertainty remains regarding the exact phishing kit or payload delivered, as no further content analysis is available. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any resurgence, and add the domain to internal threat intelligence feeds. Additional investigation of the “BITKUB” title may reveal whether the infrastructure is shared with other campaigns, and any future re‑registration should be flagged immediately.