coccin[.]vip

The domain coccin.vip was registered on February 21, 2026 and is currently listed as offline. DNS resolution points to the IPv4 address 134.122.140.226, which is attributed to CTG Server Limited operating under AS152194 in Japan. The site presents a page title of "Coinbase" and is classified as a crypto‑scam that impersonates the legitimate Coinbase brand.

Security telemetry shows that the domain appears on a single blocklist, specifically PhishDestroy, and has been flagged by fifteen of ninety‑three security vendors on VirusTotal. The SSL certificate associated with the domain is identified as R13, indicating a legacy certificate that may lack modern cryptographic protections. Although the domain’s hosting IP and blocklist presence are confirmed, no additional intelligence such as the underlying phishing kit, HTTP response codes, or content snapshots has been disclosed.

Consequently, the full scope of the malicious payload and any potential credential‑harvesting mechanisms remain unknown. Defenders should add coccin.vip to network‑level deny lists, monitor the associated IP address for any future activation, and ensure that endpoint protection solutions are updated to include the observed VirusTotal detections. Continuous observation of related indicators, such as newly registered domains resolving to the same IP range or exhibiting similar SSL characteristics, is recommended to pre‑empt possible re‑use of this infrastructure.