colnbaseymh[.]org

The domain colnbaseymh.org was registered on November 07, 2025 through Gname.com Pte. Ltd. and resolves to IP 148.178.16.47, which is allocated to AS54801 Zillion Network Inc. in Hong Kong. The site employed the nameservers a.share-dns.com, a4.share-dns.com, b.share-dns.net, and b4.share-dns.net. No TLS certificate was observed, indicating the site operated over plain HTTP. The page title observed was "Colnbase One-stop global investment with professional forex trading and digital asset services", suggesting a financial or crypto investment narrative.

The domain is explicitly associated with a cryptocurrency scam that impersonates Coinbase, as indicated by the brand target field. Google Safe Browsing flags the site for social engineering, and Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme lack of trust. VirusTotal scans recorded 15 detections out of 95 security vendors, confirming malicious classification. The domain appears on one security blocklist and has been taken offline, with the takedown action credited to PhishDestroy.

The combination of a brand impersonation, lack of SSL, low trust score, and multiple vendor detections classifies the infrastructure as high‑risk. Defenders should continue to block the domain at DNS and network layers, monitor for any re‑registration attempts, and incorporate the observed indicators—such as the IP address, nameserver set, and page title—into threat‑intel feeds. Until the domain is fully remediated, any traffic to colnbaseymh.org should be assumed hostile.