Highscore 56 · flagged Tuesday, September 15, 2026

cbs-verify.cfd

Appeared in the .cfd zone on Tuesday, September 15, 2026; by the end of that day the census found active website about crypto web3. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

lure words (login, verify, secure…)
matched: verify
+6
TLD with a high abuse rate
matched: cfd
+8
page impersonates a brand
matched: Coinbase
+22
brand in page title, not in the name
matched: coinbase
+20
Registrar
Nameserver provider
Nameservers
porter.ns.cloudflare.com, wally.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
Coinbase Commerce | Wallet Verification
Has a form
no
Brand echoed

Model opinions

Second opinionlooks like phishingtarget: Coinbaseconfidence 96%· claude-opus-5

Page reproduces the Coinbase Commerce logo and branding under a non-Coinbase domain (cbs-verify.cfd) with a fake 'KYC & Wallet Verification / your wallet is not verified' compliance lure and a 'Verify wallet now' CTA — the classic wallet-drainer flow that harvests seed phrases or signature approvals; a live-chat widget indicates an operator standing by.

First passlooks like phishingtarget: Coinbaseconfidence 98%· claude-haiku-4-5

Domain cbs-verify.cfd impersonates Coinbase Commerce with the official logo, branding, and KYC/wallet verification flow. The page falsely claims the wallet is unverified and demands action to comply with AML rules, using urgency and Coinbase's legitimate compliance language to deceive users into providing credentials or private keys. The sealed-room design (form posting to itself, no links) and typosquat domain confirm phishing intent.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, September 15, 2026

Screenshot of cbs-verify.cfd taken by the zone census on 2026-09-15

Same data as JSON: /api/zone/domain/cbs-verify.cfd. This page is not indexed by search engines and does not link to the site it describes.