coinmarketcap[.]cab

coinmarketcap.cab is currently offline but historical observations indicate it was used for a generic phishing operation. The domain was registered on 21 February 2026 through NameSilo, LLC and resolves to the IP address 167.148.195.211, which belongs to DEDIK SERVICES LIMITED in the Netherlands (AS207043). No TLS certificate was detected, and the HTTP service returned the default Plesk Obsidian 18.0.74 page title, implying the site was hosted on a Plesk control panel without custom content. The infrastructure is served by DNS Owl nameservers (ns1.dnsowl.com, ns2.dnsowl.com, ns3.dnsowl.com).

Reputation checks show a Gridinsoft trust score of 0 / 100 and Google Safe Browsing classifies the domain as social engineering. The domain appears on three public blocklists—PhishDestroy, MetaMask, and SEAL—and is referenced in one AlienVault OTX pulse. VirusTotal analysis recorded detections by 16 of 93 scanning engines, reinforcing the malicious assessment.

The convergence of blocklist inclusion, low trust score, lack of SSL, and the generic Plesk landing page is consistent with a phishing staging site that was likely taken down after detection. Defenders should continue to block any resolution of coinmarketcap.cab, monitor for reuse of the underlying IP or nameserver set, and update internal filtering rules to include the listed blocklists. Incident response teams should treat any email or web traffic referencing the domain as malicious and consider notifying the registrar to enforce takedown if the site resurfaces.