cdcashbase[.]com

Analysis of cdcashbase.com, first observed on December 29 2025, indicates an active high‑risk brand‑impersonation operation that presents itself as a CFD trading platform. The domain resolves to the IPv4 address 92.204.41.13, which is allocated to AS29066 (velia.net Internetdienste GmbH) in France. Hosting is provided by OrangeHost LLC, as evidenced by the registrar information and the set of authoritative name servers (dns1.afeeshost.ltd, dns2.afeeshost.ltd, dns3.afeeshost.com, ns41.afeeshost.com, ns42). The site serves content over HTTPS using a Let’s Encrypt R12 certificate, and the HTTP response is a 302 redirect, suggesting an attempt to manipulate traffic flow. The page title returned by the server – “CDcashbase | CFD Trading — Trading on Stocks, Gold, Oil, Indices” – aligns with the declared scam type of a crypto‑related financial scheme.

VirusTotal has recorded five detections out of ninety‑three scanning engines, confirming that multiple security products flag the domain as malicious. The domain is listed on a single public blocklist and is actively blocked by the PhishDestroy service. Additionally, AlienVault OTX references the domain in one threat‑intel pulse, reinforcing its association with malicious activity. Independent reputation scoring from Gridinsoft assigns a trust score of 12 / 100, indicating a very low level of credibility.

While the available data clearly demonstrate malicious intent, the specific payload or credential‑ harvesting mechanisms employed by the site have not been disclosed, and no detailed content analysis is available. Defenders should therefore block DNS resolution for cdcashbase.com, enforce HTTPS inspection to capture the redirected payload, and add the IP address 92.204.41.13 to network‑level deny lists. Continuous monitoring of the associated ASN and the OrangeHost hosting environment is recommended, as the infrastructure may be reused for future campaigns.