cbffze-coinbase[.]com

The domain cbffze-coinbase.com is identified as a brand impersonation threat targeting Coinbase. This fraudulent domain is designed to mimic legitimate Coinbase operations, attempting to deceive users into compromising their credentials. The lack of an SSL certificate further supports its malicious intent, indicating no effort to secure communications.

Analysis of cbffze-coinbase.com reveals several technical indicators of its malicious nature. The domain appears on 1 security blocklist and is flagged by 15 out of 95 security vendors on VirusTotal. It was registered through NiceNIC International Group Co., Limited on December 03, 2025, and it resolves to the IP address 91.92.241.15, located in the Netherlands under AS202412 Omegatech LTD. The domain currently remains active, despite being blocked by PhishDestroy.

Given its current active status, the domain continues to pose a significant threat to users, particularly those associated with or using Coinbase services. Immediate response actions should include updating security blocklists and educating potential victims about this specific threat. Continuous monitoring for any changes in its status or new associations is recommended to mitigate the risk posed by this impersonation domain.