45231-cb[.]com

The domain 45231-cb.com has been identified as a credential theft operation impersonating Apple, despite displaying a Coinbase-themed login interface. Analysis confirms the domain is currently offline, though it previously functioned as an active threat vector targeting users through brand confusion and deceptive page titles. The specific threat type involves credential harvesting under the guise of a trusted cryptocurrency platform, while leveraging Apple’s brand reputation to enhance credibility. Infrastructure analysis reveals the domain was registered on October 19, 2025, through Name SRS AB, a registrar frequently associated with high-risk domains. It resolved to the IP address 196.251.87.9, geolocated in the Netherlands, and was flagged by 16 of 95 security vendors on VirusTotal. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and was assigned an SSL certificate with the identifier R12. Detection counts and blocklist inclusions align with patterns observed in coordinated phishing campaigns targeting financial and technology sector users. Current status indicates the domain has been taken offline, though residual risk remains due to the infrastructure’s recent activity. Organizations and individuals are advised to monitor for related domains registered under the same registrar or resolving to the identified IP. Network-level blocking of 196.251.87.9 is recommended to mitigate potential lateral movement. Users should verify domain authenticity before entering credentials, particularly when redirected from unexpected sources or prompted by unsolicited communications.