dech[.]bu-kk[.]vip

Analysis of the domain dech.bu-kk.vip indicates that the site was used to impersonate Coinbase and to promote a cryptocurrency‑related scam. The domain was registered on 7 September 2025 through Gname.com Pte. Ltd. and is delegated to the authoritative nameservers a8.share-dns.com and b8.share-dns.net. DNS resolution points to the IPv4 address 8.209.102.168, which is allocated to AS45102, identified as Alibaba (US) Technology Co., Ltd., and geolocated to Germany. No TLS certificate was presented, implying that the site operated over plain HTTP only.

The page title returned by the server was “Index - Coinbase OTC”, matching the declared brand target of Coinbase and the listed scam type “Crypto Scam”. VirusTotal recorded 11 detections out of 93 scanning engines, and Google Safe Browsing classified the URL as a social‑engineering threat. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Current monitoring shows the site is offline, and the unique seed 6212e2 links this observation to a broader intelligence set.

While the observed infrastructure confirms the intent to deceive Coinbase users, the lack of SSL and the offline status limit immediate exploitation. Defenders should add the domain and its associated IP address to their deny lists, monitor the registrar Gname.com for any new registrations that reuse the same nameservers, and enforce strict URL filtering for any HTTP resources referencing “Coinbase OTC”. Network telemetry should also be inspected for any outbound connections from internal hosts to the resolved IP, as compromised browsers could still attempt to contact the endpoint before it was taken down. Continuous re‑evaluation is advised in case the infrastructure is re‑hosted under a different IP or the domain is reactivated.