Here’s what I could find out:

• There’s a website coconutbratpac.com with basically nothing on it
• According to WHOIS records, that website and the website in the text message (which seems to purely be a link shortener) were both updated within about an hour of each other on September 16
• There’s a third website (onlyfans.vote) which explicitly mentions CBP in its privacy policy; that domain was updated on August 11.
• I get no hits for “coconut” using Open Secrets’ PAC Search, but I don’t know how often they update their database or what blind spots it might have.
• One of the few Google hits I got was for this reddit post which has an unredacted link. That link ultimately redirects to Rapid Resist, which is a legitimate Democrat-aligned organization used for text campaigns. So maybe this is legitimate but incredibly half-assed?