xn--cnbscmdwnladwllets-twok9g7igcd42d10185adai[.]new[.]gr[.]com

The domain cnbscmdwnladwllets.new.gr.com is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting Coinbase. The sole page observed returns a HTTP 521 response via Cloudflare’s edge network and presents the title “Coinbase Wallet extension – Chrome Web Store”, indicating an attempt to mimic the official Chrome Web Store listing. Infrastructure analysis shows the domain was registered through Key‑Systems GmbH, uses the public DNS servers ns1‑ns4.centralnic.net, and resolves to the IPv6 address 2606:4700:3034::ac43:c270 owned by AS13335 Cloudflare, Inc., located in the United States. The site serves a Let’s Encrypt/E8 certificate and employs HTTP/3. VirusTotal scans have recorded detections by seven of ninety‑five AV engines, and the domain appears on one external blocklist. It has also been added to the PhishDestroy blocklist. While the page content beyond the title has not been publicly captured, the technical indicators strongly suggest a credential‑harvesting or crypto‑drain scheme leveraging the Coinbase brand. Defenders should block the domain at DNS and proxy layers, add the IPv6 address to network‑level deny lists, and monitor for similar Cloudflare‑hosted subdomains registered via Key‑Systems. Ongoing observation is advised to detect any shift in payload or additional infrastructure.