coca[.]xyz

The domain coca.xyz was a brand-impersonation phishing site targeting users of the 'across' platform. It posed as a legitimate rewards program under the title 'Turn Your Spending Into Rewards' but was designed to harvest credentials or sensitive information through a seed-phishing scam. No crypto drainer kit was identified. The site is currently taken offline, though it remains under investigation for its activities.

Technical indicators show coca.xyz had 0 of 95 VirusTotal vendors flagging it as malicious, and Google Safe Browsing did not list it as unsafe. However, it appeared on 1 security blocklist (PhishDestroy). The domain was registered through NameCheap, Inc. on April 18, 2023, and resolved to the IP address 34.149.87.45, hosted on Google Cloud (AS396982). The SSL certificate was issued by Google Trust Services / WR1. Additional trust scores included 23/100 from Gridinsoft and 37/100 from Scamadviser. Detected technologies included Wix, Bootstrap, React, and RequireJS. MX records pointed to Google's mail servers, and only one nameserver was observed.

Users who interacted with coca.xyz should immediately change any passwords entered on the site, enable two-factor authentication (2FA) on their accounts, and monitor for unauthorized transactions or login attempts. If financial or personal data was exposed, consider placing a fraud alert on credit reports. Report the domain to the impersonated brand (across) and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in takedown efforts.