cbbvx-coinbase[.]com

Analysis of the domain cbbvx-coinbase.com indicates a high-risk crypto scam impersonating Coinbase, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 91.92.241.15, hosted on AS202412 (Omegatech LTD) in the Netherlands. Infrastructure review reveals the domain is associated with nameservers ns1.virtualine.org and ns2.virtualine.org, a configuration commonly observed in fraudulent operations. No SSL certificate is present, increasing the likelihood of unencrypted data transmission, a red flag for phishing or scam activity.

The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is flagged by 12 of 95 security vendors in VirusTotal, though the exact detection context remains unverified. The page title 'Checking Connection - Please Wait' suggests an attempt to mimic a loading or verification process, a tactic often used to delay user interaction while malicious scripts execute or credentials are harvested. The absence of further content analysis limits conclusions about specific payloads or attack vectors, but the combination of brand impersonation, crypto scam classification, and blocklist presence confirms malicious intent. Defenders should treat this domain as compromised and maintain its inclusion on blocklists.

Network-level monitoring for connections to 91.92.241.15 or the associated nameservers is recommended to prevent potential credential theft or unauthorized transactions. Given the domain's offline status, no immediate user-facing threat exists, but historical DNS records should be reviewed for prior malicious activity. Organizations should also assess whether internal systems or users interacted with this domain before its takedown to mitigate potential exposure.