cbzos-coinbase[.]com

The domain cbzos-coinbase.com was observed hosting a crypto‑scam page that imitates the Coinbase brand. Registration data shows the domain was created on 27 February 2026 and is registered through NiceNIC International Group Co., Limited. The authoritative name servers are ns1.virtualine.org and ns2.virtualine.org. DNS resolution points to the IPv4 address 91.92.241.15, which belongs to AS202412 (Omegatech LTD) located in the Netherlands.

No TLS certificate is presented; HTTP requests return a plain‑text page whose title is “Checking Connection - Please Wait”. VirusTotal analysis recorded detections from seven of ninety‑three scanning engines, indicating that multiple security products consider the host suspicious. The domain appears on three public blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. Current monitoring shows the site is taken offline, but the infrastructure remains allocated and could be re‑used.

Evidence confirms a deliberate brand impersonation of Coinbase for a crypto‑draining scam, yet the exact payload or credential‑capture mechanism has not been publicly disclosed. Uncertainty remains around any additional hosting changes, the presence of command‑and‑control infrastructure, and whether the domain was ever used in active phishing campaigns. Defenders should add the domain and its resolving IP to network‑level deny lists, monitor for re‑registration or DNS changes, and enforce URL filtering that blocks known blocklist entries. Continuous vigilance for similar “cbzos‑*” patterns and rapid sharing of any new indicators with threat‑intel platforms are recommended.