play[.]coavox[.]com

This domain, play.coavox.com, is identified as a credential harvesting phishing endpoint targeting users through deceptive login interfaces. Analysis indicates the infrastructure was designed to mimic legitimate authentication portals, likely to capture sensitive credentials such as usernames, passwords, and multi-factor authentication tokens. The domain exhibits characteristics consistent with large-scale phishing campaigns, including the use of cloud-based hosting and rapid deployment tactics to evade initial detection. Infrastructure analysis reveals the domain was registered on May 25, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. At the time of assessment, the domain resolved to the IP address 104.21.89.131, a Cloudflare-associated address commonly leveraged to obfuscate malicious infrastructure. Detection metrics indicate 16 out of 95 security engines flagged the domain as malicious, while it appears on one active security blocklist. The domain has since been taken offline, though residual risk may persist for users who interacted with it prior to deactivation. Users who visited play.coavox.com or entered credentials on any associated page should immediately revoke active sessions and reset passwords for all potentially compromised accounts. Multi-factor authentication tokens generated during the interaction period should be invalidated and replaced. System administrators are advised to monitor network logs for connections to 104.21.89.131 and review endpoint telemetry for indicators of credential misuse. If browser-based interactions occurred, clearing cached data and running a full security scan is recommended to mitigate secondary infection vectors.