cbefd-coinbase[.]com

The domain cbefd-coinbase.com was registered on February 21, 2026 and is presently taken offline. DNS resolution points to the IP address 212.1.212.138, which belongs to Hostinger International Limited operating under ASN AS47583 and is geolocated in the United States. The hosting provider and IP association suggest a typical low‑cost web‑hosting environment often leveraged for malicious campaigns. An SSL certificate identified as rating R12 is present, indicating a low trust score and providing minimal cryptographic assurance.

The page title returned from the live endpoint, prior to takedown, was "Checking Connection - Please Wait," a generic phrase commonly used in credential‑harvesting redirects but without further page content disclosed. VirusTotal analysis recorded six detections out of ninety‑three scanners, demonstrating that multiple security engines recognized the domain as malicious, though the exact detection signatures were not disclosed. The domain appears on a single known blocklist, PhishDestroy, confirming that at least one external reputation service has flagged it. The threat profile is classified as a crypto scam that impersonates Coinbase, aligning with the brand target listed in the intelligence.

Defenders should immediately add cbefd-coinbase.com to network deny lists, enforce DNS sink‑holing for the associated IP, and monitor for any resurgence of the domain or its hosting infrastructure. Continuous observation of Hostinger‑owned IP ranges for similar patterns is advised, as is periodic re‑scanning of the domain’s certificate and metadata to detect potential re‑registration attempts. The available evidence provides a clear indication of malicious intent, though the specific payload or credential‑collection mechanisms remain undisclosed pending further forensic capture.