wallet-cobo-us[.]pages[.]dev

PhishDestroy identifies wallet-cobo-us.pages.dev as an active crypto drainer domain impersonating Cobo Wallet infrastructure. The threat leverages Cloudflare Pages to host a deceptive frontend designed to trick users into authorizing fraudulent cryptocurrency transactions. While no drainer kit fingerprint is publicly confirmed, behavioral analysis suggests automated token approval and transfer mechanisms typical of modern crypto-draining campaigns targeting Web3 users.

This domain was flagged with 2 out of 95 detections on VirusTotal as of latest scan, indicating it remains undetected by most antivirus engines. It resolves to IP 188.114.96.3 via Cloudflare, Inc. as registrar and uses a Google Trust Services SSL certificate. The domain is hosted on Cloudflare Pages, a common tactic to obscure origin servers and evade takedown. Google Safe Browsing (GSB) status and blocklist inclusion remain unverified at this time.

wallet-cobo-us.pages.dev is currently active and poses a high risk to cryptocurrency users. PhishDestroy recommends immediate avoidance and network-level blocking of the domain and IP. Users who may have interacted with the site should revoke any unauthorized token approvals, transfer suspicious transactions, and rotate private keys or seed phrases as a precaution. Until threat intelligence improves and detection signatures are widely deployed, this domain remains a credible threat vector for cryptocurrency theft.