cobo-wallet-login[.]pages[.]dev

cobo-wallet-login.pages.dev is an active crypto‑drainer infrastructure observed on 29 July 2026. The domain was registered on 27 March 2026 through Cloudflare, Inc. and uses Cloudflare’s authoritative nameservers heather.ns.cloudflare.com and kip.ns.cloudflare.com. DNS resolution points to the IP address 172.66.47.113, a Cloudflare edge node that is commonly leveraged to conceal the true backend of malicious campaigns. The domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy service, indicating that at least one downstream sink has identified it as malicious. VirusTotal has recorded eight detections out of ninety‑one scanning engines, confirming that multiple security vendors have flagged the host as suspicious or malicious.

The risk rating assigned by the reporting platform is elevated, and the campaign status is listed as active. Publicly available intelligence does not include a page title, SSL certificate details, or any observed landing‑page content, so the exact credential‑stealing or crypto‑drain mechanisms remain unknown. No additional contextual indicators such as OT… are present in the current dataset. Defenders should add the domain and its associated IP address to deny‑list rules at network perimeters and DNS resolvers.

Because the domain is hosted behind Cloudflare, traffic may be proxied, therefore blocking the IP alone may affect legitimate Cloudflare services; a domain‑level block is preferred. Continuous monitoring of DNS queries for the domain and its nameservers is advised, as threat actors frequently rotate sub‑domains under the same registrar. Analysts should also submit the URL to sandbox services to capture any payloads, and update detection signatures when additional indicators such as HTML content or JavaScript beacons become available.