tobac[.]cn[.]com

The domain tobac.cn.com was a generic phishing site posing no specific brand impersonation or crypto-drainer kit. It operated as a broad credential-harvesting page targeting users through deceptive login prompts before being taken offline. As of the latest verification, tobac.cn.com is no longer active, but its prior activity classified it as an elevated-risk phishing threat.

Technical indicators confirm the domain's malicious intent. VirusTotal reported 2 of 95 security vendors flagged tobac.cn.com as phishing, while Google Safe Browsing did not detect it. The domain appeared on 1 security blocklist (PhishDestroy) and was registered through Instra Corporation Pty Ltd. It resolved to the IP address 38.180.144.105, hosted by M247 Europe SRL in Austria (AS9009). The SSL certificate was issued by Google Trust Services / WR2, and the observed page title was 'Tobac web hosting'. Nameservers included ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net, with the site returning a 404 HTTP status at the time of assessment.

Users who encountered tobac.cn.com should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized access or fraudulent activity. Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in broader threat mitigation. If financial or crypto services were involved, revoke any suspicious token approvals and consider migrating funds to a new, secure wallet.