cbzvn-coinbase[.]com

This report details the threat posed by the domain cbzvn-coinbase.com. The site's page title, "Checking Connection - Please Wait," indicates it presents itself as a loading or verification page. It is a cryptocurrency scam that specifically impersonates the Coinbase brand, designed to deceive users into believing they are interacting with a legitimate Coinbase service. The threat is that visitors may be tricked into providing sensitive information or cryptocurrency credentials.

Technical evidence confirms the malicious nature of the site. On VirusTotal, it received detections from 8 out of 95 security vendors. It was flagged by blocklists from ChainPatrol, alphaMountain.ai, CRDF, CyRadar, and Fortinet, and is listed on 3 blocklists. The domain was registered on 2026-02-24 through the registrar NiceNIC International Group Co., Limited. It resolves to IP address 91.92.241.5, hosted in the Netherlands (NL) by AS202412 Omegatech LTD. The site has no SSL certificate and uses nameservers ns1.virtualine.org and ns2.virtualine.org.

The current status of cbzvn-coinbase.com is DOWN/OFFLINE. The risk level is assessed as high due to the confirmed impersonation of a major brand, multiple vendor detections, and registration through a registrar known for facilitating malicious domains. Although offline, the domain could be reactivated or used to host similar threats in the future.