cbmny-coinbase[.]com

The domain cbmny-coinbase.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently taken offline. Infrastructure analysis shows it resolves to the IPv4 address 91.92.241.15, which is allocated to AS202412 owned by Omegatech LTD and geolocated to the Netherlands. The domain uses the authoritative name servers ns1.virtualine.org and ns2.virtualine.org and does not present an SSL/TLS certificate, indicating that any traffic would be unencrypted. The only observed HTTP response contained the page title “Checking Connection – Please Wait”, which is consistent with a typical redirect or loading page used in credential‑harvesting flows.

Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on three external blocklists. It is also flagged by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal reports that ten out of ninety‑five anti‑malware engines flagged the host as malicious, reinforcing the suspicion of abuse. The site is classified as a crypto‑related scam and specifically attempts to impersonate the Coinbase brand, matching the reported brand target.

Evidence gaps remain regarding the exact content served before takedown, the presence of any malicious payloads, and the command‑and‑control infrastructure that may have been used. Defenders should add the IP address 91.92.241.15 to network‑level deny lists, block the domain and its name servers at DNS filters, and monitor for any outbound connections to the host. Email gateways should enforce strict sender‑policy checks for messages purporting to originate from Coinbase and quarantine any links to cbmny-coinbase.com. Continuous re‑query of threat‑intel feeds is advised to capture any re‑hosting attempts or related domains that share the same registrar or hosting provider.