vmi2908862[.]contaboserver[.]net

The domain vmi2908862.contaboserver.net was observed hosting a page whose title reads "Coinbase", indicating an attempt to impersonate the cryptocurrency exchange Coinbase. Registration data show the domain was created on March 5, 2017 and was registered through RegistryGate GmbH. The authoritative nameservers listed are ns1.contabo.net, ns2.contabo.net, and ns3.contabo.net, which are operated by Contabo GmbH. DNS resolution points to the IPv4 address 164.68.104.244, an IP located in France and assigned to AS51167 (Contabo GmbH).

No SSL certificate is presented for the host, meaning connections are made over plain HTTP. VirusTotal analysis recorded four detections out of ninety‑three scanned security vendors, suggesting a moderate level of malicious classification. The domain is present on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Current monitoring indicates the site has been taken offline, but the historical evidence confirms a crypto‑related scam infrastructure targeting Coinbase users.

Defenders should ensure that any outbound connections to 164.68.104.244 are denied or closely inspected, update URL filtering rules to include vmi2908862.contaboserver.net, and consider adding the domain to internal blocklists. Given the registrar and hosting provider are legitimate services, the malicious activity is likely the result of compromised or rented resources rather than a dedicated malicious registrar. Continuous observation of the IP range owned by Contabo GmbH is advised, as additional phishing or crypto‑draining sites may be deployed from the same infrastructure.