coapax[.]com

This domain, coapax.com, is currently under investigation for generic phishing activity designed to harvest user credentials, likely targeting financial services or online payment platforms. As of the latest verification, the domain has been taken offline, though prior infrastructure analysis indicates it was actively used in phishing campaigns. No specific brand impersonation has been confirmed, but the domain’s structure and hosting patterns align with credential theft operations observed in similar threat clusters. Infrastructure analysis reveals the following technical indicators: coapax.com resolves to the IP address 69.67.173.34, a host previously associated with low-reputation bulletproof infrastructure. The domain was registered on May 27, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently observed in phishing and fraudulent domain registrations. Despite its malicious intent, the domain has not yet been flagged by any of the 95 vendors on VirusTotal, though it appears on three independent security blocklists. The SSL certificate is issued by Let’s Encrypt (serial number E8), a common choice for threat actors due to its free and automated issuance process. The creation date, set in the future, suggests either a typo-squatting attempt or an error in registration data, which is a red flag in itself. Current status indicates the domain is offline, though this does not preclude reactivation or migration to a new host. Organizations and users are advised to treat coapax.com as malicious and implement the following mitigations: block the domain and its associated IP (69.67.173.34) at the network perimeter; monitor for any future resolutions or DNS changes; and alert security teams to investigate potential exposure if the domain was accessed prior to takedown. Given the domain’s presence on multiple blocklists, automated threat feeds should be updated to include this indicator. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly those tied to financial or sensitive services.