cbkfs-coinbase[.]com

This domain, cbkfs-coinbase.com, was identified as a brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain was created on February 21, 2026, and is currently offline. The page title observed during active monitoring was 'Checking Connection - Please Wait,' which may suggest a placeholder or intermediate page used in the attack chain. Infrastructure analysis reveals the domain resolved to an IPv6 address (2a02:4780:45:304:7007:93a6:a2a6:133c) hosted on AS47583 (Hostinger International Limited) in Germany.

The SSL certificate is classified as R13, a detail that may aid in tracking related infrastructure. Detection data shows the domain was flagged by 6 of 93 security vendors on VirusTotal, though this does not represent a comprehensive assessment of its maliciousness. It appears on one security blocklist and is blocked by PhishDestroy. The scam type is classified as a crypto scam, aligning with the impersonation of Coinbase.

Defenders should treat this domain as a confirmed brand impersonation threat, particularly given its association with cryptocurrency fraud. While the domain is currently offline, historical resolution data and SSL certificate details may be useful for retrospective hunting or correlation with other malicious activity. No additional details about the specific phishing kit or attack methodology are available at this time. Organizations should ensure this domain is blocked at the network and endpoint levels and monitor for any re-emergence or related infrastructure.