cbwbonline[.]org

cbwbonline.org is an active domain registered on March 08, 2026 through Ultahost, Inc. The site resolves to IP 66.23.226.51, an address owned by Interserver, Inc. in the United States. The domain is currently resolving with HTTP status 200 and presents a page titled “CBW Bank”. Its authoritative nameservers are vda7700a.trouble-free.net and vda7700b.trouble-free.net, and the TLS certificate is issued by ZeroSSL ECC Domain Secure Site CA. Technical fingerprinting shows the site runs LiteSpeed web server with HTTP/3 support and leverages Bootstrap, jQuery, Popper, OWL Carousel, Smartsupp, and YouTube embeds. The presence of a banking‑style landing page combined with the page title indicates a targeted banking phishing campaign. VirusTotal analysis shows 14 of 95 scanned security vendors flag the host, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The evidence points to a high‑risk banking phishing operation that mimics the brand “CBW Bank”. While the content delivery infrastructure is clearly identified, no payload samples or credential‑harvesting mechanisms have been publicly disclosed, leaving the exact phishing workflow uncertain. The short lifespan of the domain—created only four months ago—suggests a fast‑flux or throwaway approach typical of credential‑stealing campaigns. Defenders should immediately block DNS resolution to cbwbonline.org and add the IP 66.23.226.51 to network‑level deny lists. Monitoring for HTTP/3 traffic to the host and inspecting outbound connections to the embedded YouTube resources may reveal compromised clients. Email gateways should enforce URL filtering for the domain, and incident response teams should prepare to capture any credential submissions that may be routed through the site. Continuous re‑evaluation is advised, as the threat actor may shift to new infrastructure after takedown.