cboebnvw[.]com

This domain represents a targeted brand impersonation threat designed to mimic UPS shipping portals and delivery tracking systems. Analysis indicates the site employs social engineering tactics typical of parcel fraud schemes, where victims receive fabricated shipping notifications via email or SMS containing links to cboebnvw.com. The fraudulent pages harvest login credentials, payment details, and personal information under the guise of resolving delivery issues or accessing package tracking information. The domain specifically exploits UPS branding elements, including color schemes, logos, and service terminology, to create a false sense of legitimacy for unsuspecting recipients. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on November 19, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent registrations. It currently appears on two independent security blocklists and is flagged by 18 of 95 security vendors on VirusTotal, including specialized anti-phishing engines. The domain resolves to IPv6 address 2606:4700:3037::6815:4482, hosted on Cloudflare's network (AS13335), which provides anonymization services commonly exploited by threat actors. Notably, the SSL certificate issued by Google Trust Services (WE1) creates a false appearance of security while the page title displays 'Cboe,' suggesting either misconfiguration or deliberate obfuscation of the true purpose. Users who visited cboebnvw.com should immediately revoke any credentials entered on the site and monitor financial accounts for unauthorized transactions. The domain has been taken offline, but similar fraudulent sites may emerge using comparable infrastructure patterns. Security teams should block the domain and associated IP address at the network level. Individuals who received suspicious shipping notifications should verify delivery status directly through UPS official channels and report the incident to relevant fraud reporting platforms. The combination of recent registration date, Cloudflare hosting, and multiple security vendor detections provides strong evidence of malicious intent.