cobera[.]app

This domain operates as a cryptocurrency wallet credential harvesting site, specifically designed to mimic legitimate wallet interfaces for the purpose of stealing private keys and recovery phrases. Analysis indicates the site employs deceptive user interface elements that closely resemble authentic wallet applications, likely targeting users of popular cryptocurrency platforms through social engineering tactics. The infrastructure shows characteristics typical of credential theft operations, including form fields designed to capture sensitive wallet information without proper encryption or security controls. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain cobera.app was registered on April 03, 2026 through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with fraudulent domains. It resolves to IP address 193.142.59.10 and is currently flagged by 16 out of 95 security vendors on VirusTotal, with detections from major security engines. The domain appears on three separate security blocklists and maintains a Gridinsoft trust score of 19 out of 100, indicating extremely low reputation. Additional threat intelligence confirms its presence in one AlienVault OTX pulse, further validating its malicious classification. Users who have visited cobera.app or entered any information on the site should immediately consider their cryptocurrency wallets compromised. Affected individuals should transfer all assets to a new wallet with a fresh seed phrase, revoke any connected dApp permissions, and monitor all linked accounts for unauthorized transactions. It is critical to avoid reusing passwords or recovery phrases from compromised wallets. Organizations should update their security controls to block this domain and its associated IP address, while security teams should investigate any internal systems that may have interacted with the malicious infrastructure.