wmbtcoins[.]cc

The domain wmbtcoins.cc was identified as a brand impersonation threat targeting Google. Analysis confirms the domain operated as a phishing site, leveraging the Google brand to deceive users. The domain is currently offline, but prior activity aligns with credential harvesting or fraudulent service promotion. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on June 13, 2025, and resolved to the IP address 104.18.20.48. Detection metrics indicate 5 of 95 security vendors on VirusTotal flagged the domain as malicious. It was listed on two security blocklists, including PhishDestroy and OISD. The Gridinsoft trust score for the domain was 0 out of 100, further corroborating its malicious classification. The page title, 'Home,' suggests an attempt to mimic a legitimate landing page while obscuring its true intent. The domain is currently offline, but residual risk remains for users who may have interacted with it prior to takedown. Organizations are advised to block the domain and its associated IP (104.18.20.48) at the network level. Security teams should review logs for connections to wmbtcoins.cc and monitor for indicators of compromise, such as unauthorized access attempts or unusual authentication activity. End users should be alerted to the threat, particularly if they were directed to the site via unsolicited communications. Proactive measures, including credential resets for potentially exposed accounts, are recommended.