cbgeo-coinbase[.]com

Analysis of the domain cbgeo-coinbase.com, first observed on March 03, 2026, indicates a credential‑harvesting campaign targeting Coinbase users. The domain is registered through NiceNIC International Group Co., Limited and resolves to the IPv4 address 91.92.241.15, which is announced by AS202412 belonging to Omegatech LTD in the Netherlands. No TLS certificate is presented; the site serves HTTP only, which is consistent with the lack of SSL. The page title returned by the HTTP response is “Checking Connection – Please Wait”, a generic placeholder that does not reveal the underlying content.

Nameserver records point to ns1.virtualine.org and ns2.virtualine.org, suggesting the use of a third‑party DNS provider. VirusTotal has recorded eight detections out of ninety‑four scanning engines, confirming that multiple security products classify the domain as malicious. Independent blocklist monitoring shows the domain listed on three public blocklists and it is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of a crypto‑related phishing operation. The intelligence tags the campaign as a “Crypto Scam” and explicitly notes impersonation of the Coinbase brand.

Uncertainty remains regarding the exact phishing page layout, credential capture mechanism, and any additional infrastructure components that may be leveraged beyond the observed IP address. Defenders should add the domain and its resolved IP address to outbound and inbound filtering rules, monitor DNS queries for the associated nameservers, and ensure that any user‑facing applications that interact with Coinbase services enforce strict TLS validation. Incident response teams should treat any login attempts to this domain as compromised and advise users to change Coinbase credentials if exposure is suspected.