cobbaavvc[.]top

Analysis of cobbaavvc.top indicates a newly registered domain created on 21 February 2026 that is being used for a cryptocurrency‑related brand impersonation campaign targeting Coinbase users. The domain resolves to the IP address 103.108.41.18, which is assigned to ASN 135581 (ONL‑HK) and geolocated to Hong Kong. Registration was performed through Gname.com Pte. Ltd., and the authoritative name servers are a.share-dns.com. and b.share-dns.net. The site presented the page title “Coinbase,” matching the declared brand target, and the SSL certificate is identified as “R12.” Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme suspicion.

VirusTotal reports that 16 of 93 scanned security vendors flagged the domain, confirming malicious intent. The domain appears on at least one security blocklist, specifically PhishDestroy, and has been taken offline at the time of this report. The overall risk rating is elevated. The available evidence confirms that cobbaavvc.top was used to impersonate Coinbase in a crypto scam, but no additional details about the payload, credential‑harvesting pages, or command‑and‑control infrastructure have been disclosed.

Because the site is currently offline, real‑time verification of the HTTP response or content is not possible, and the exact phishing kit or page structure remains unknown. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any reuse of the underlying IP address or name‑server infrastructure, and update threat‑intel feeds with the observed indicators. Additional scrutiny of traffic to the associated IP range (AS135581) and the registrar Gname.com Pte. Ltd. is recommended to detect possible redeployment of similar impersonation campaigns. Ongoing collection of endpoint and proxy logs for attempts to resolve cobbaavvc.top will aid in rapid detection should the domain reappear.