dech[.]cbimsb[.]cyou

The domain dech.cbimsb.cyou was registered on July 01, 2025 through Gname.com Pte. Ltd. and is presently taken offline. Passive DNS shows it resolved to the IPv4 address 8.209.102.168, which is assigned to AS45102 Alibaba (US) Technology Co., Ltd. and geolocated in Germany. The authoritative name servers a12.share-dns.com and b12.share-dns.net are typical of shared‑hosting services and provide no additional attribution. No TLS certificate was observed for the site, indicating that the service was delivered over plain HTTP.

The only visible content, as captured in a snapshot, carried the page title "Index - Coinbase OTC," directly referencing the Coinbase brand. This aligns with the reported brand target of Coinbase and the classification of the activity as a crypto‑related scam. VirusTotal analysis recorded 15 detections out of 93 security vendors, confirming that a notable fraction of scanning engines consider the domain malicious. The domain appears on a single external blocklist and has been specifically listed by PhishDestroy as a blocked resource.

While the site is no longer reachable, the infrastructure details—including the Alibaba‑owned IP range and shared DNS—remain reusable for future impersonation campaigns. Defenders should update URL filtering rules to block the domain and any sub‑domains, enforce blocklisting of the associated IP address, and monitor for similar name‑server patterns. Network sensors should also flag HTTP traffic to 8.209.102.168 and correlate it with known Coinbase‑related phishing signatures. Continuous verification of the registrar’s activity and the hosting AS is recommended to detect re‑use of the same infrastructure for new impersonation attempts.