cbsho-coinbase[.]com

The domain cbsho-coinbase.com was registered on December 16, 2025 through NiceNIC International Group Co., Limited and is hosted on the IPv4 address 91.92.241.15. The IP resolves to a server located in the Netherlands and is announced by AS202412 owned by Omegatech LTD. Nameserver delegation points to ns1.virtualine.org and ns2.virtualine.org, and the site does not present an SSL/TLS certificate, indicating that communications occur over plain HTTP. The only observed HTTP response includes the page title "Checking Connection - Please Wait," which is typical of staged redirection pages used in credential‑harvesting campaigns.

VirusTotal analysis records eleven detections out of ninety‑five scanned security vendors, and Gridinsoft assigns a trust score of zero out of one hundred, both indicating a high likelihood of malicious intent. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Classification from the supplied intelligence identifies the activity as a crypto‑related scam that impersonates the Coinbase brand, and the overall risk level is marked as elevated.

As of the report date, the domain is offline, but historical evidence suggests it was previously used for brand impersonation. Defenders should continue to block the domain and its associated IP address at network perimeter controls, incorporate the nameservers and registrar information into threat‑intel feeds, and monitor for future registrations that reuse the same registrar or naming patterns. Ongoing surveillance of the hosting ASN and related infrastructure is recommended to detect any re‑activation or replication of the observed tactics.