712403-cb[.]com

The domain 712403-cb.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and currently resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. No SSL certificate is presented for the site, indicating that connections would be made over plain HTTP. The page title observed on the domain is "Security Check," and the associated scam type is identified as a crypto scam targeting Coinbase users. Reputation checks show a Gridinsoft trust score of 0 out of 100, reflecting an extremely low confidence rating.

The domain appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat intelligence platforms have flagged it as malicious. VirusTotal analysis reports that 13 of 93 scanning vendors flagged the domain, providing additional vendor‑level corroboration of its malicious nature. Nameserver configuration points to Cloudflare’s custom name servers, kanye.ns.cloudflare.com and lilith.ns.cloudflare.com, which is a common pattern for fast‑flux or abuse‑oriented infrastructure. The site is presently taken offline, but historical evidence suggests it was used to impersonate Coinbase in order to lure victims into a cryptocurrency‑related credential harvest or fund diversion.

Uncertainty remains regarding the specific phishing page content and any payload delivery mechanisms, as the site is no longer reachable for direct inspection. Defenders should continue to block the domain at network perimeters, update URL filtering rules with the observed indicators, and monitor for any resurgence of the same infrastructure, especially traffic to the associated IP or Cloudflare name servers. Incident response teams should also correlate any recent Coinbase‑related credential disclosures with this domain to assess potential compromise scope.