cobapoauh[.]xyz

The domain cobapoauh.xyz is identified as a high-risk brand impersonation threat, currently taken offline. This domain impersonates the brand Coinbase, posing a significant risk to users who may be misled into believing they are interacting with a legitimate Coinbase service.

Analysis indicates that cobapoauh.xyz is flagged by 14 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection and potential threat. The domain is registered through NameSilo, LLC, and resolves to the IP address 103.108.41.17, which is located in Hong Kong and associated with the Autonomous System AS135581 ONL-HK. The domain was created on October 25, 2025, and has been listed on one security blocklist. Google Safe Browsing has also flagged this domain for phishing, and it is blocked by the security service PhishDestroy. The lack of an SSL certificate further indicates a lack of security and potential malicious intent.

The domain cobapoauh.xyz is currently offline, which reduces the immediate risk to users. However, it is recommended that users remain vigilant and avoid any links or communications related to this domain. Security teams should monitor for any reactivation of the domain and ensure that it remains blocked in network security policies. Additionally, users should be educated on the signs of brand impersonation and phishing attacks to mitigate the risk of similar threats.