scotiawealthmanagement[.]com[.]cobblestonesw[.]com

Analysis of the domain scotiawealthmanagement.com.cobblestonesw.com indicates active phishing infrastructure targeting financial services. The domain, registered on June 8, 2026, through Cloudflare, currently resolves to the IP address 104.26.14.207. This address is associated with hosting patterns commonly exploited for credential harvesting or fraudulent redirects. The domain appears on one security blocklist, and 19 of 95 security vendors in aggregated threat intelligence have flagged it as malicious. A Gridinsoft trust score of 0/100 further supports the assessment of high risk. Infrastructure analysis reveals the use of a Google Trust Services SSL certificate, which may lend a superficial appearance of legitimacy but is frequently abused in phishing campaigns. The page title, 'cobblestonesw.com | 522: Connection timed out,' suggests either a misconfigured or intentionally disrupted hosting environment, a tactic sometimes employed to evade automated analysis or prolong operational lifespan. The subdomain structure, incorporating 'scotiawealthmanagement,' implies an attempt to impersonate a legitimate financial institution, though no direct evidence of brand-specific content has been confirmed at this stage. Defenders should treat this domain as active and high-risk. Immediate action includes blocking resolution at the DNS level, adding the domain and associated IP to firewall and proxy deny lists, and monitoring for internal connections to 104.26.14.207. Given the domain's recent registration and Cloudflare-backed hosting, defenders should also review logs for prior connections, as this infrastructure is often reused across multiple campaigns. No evidence currently links this domain to a specific phishing kit or payload, but the combination of subdomain spoofing, blocklist presence, and vendor detections warrants proactive containment.