# coinbase-accessvault.com — SUSPICIOUS

> PhishDestroy identifies coinbase-accessvault.com as a Coinbase impersonation domain designed to steal credentials.

## Summary
PhishDestroy identifies coinbase-accessvault.com as an active brand impersonation domain targeting Coinbase users. The domain mimics legitimate cryptocurrency service portals to harvest login credentials and sensitive financial data. While no drainer kit artifacts have been retrieved from this campaign, the fraudulent interface is likely preconfigured to siphon user inputs to a remote server controlled by the operators.


This domain was flagged with a VirusTotal detection score of 4/95 security vendors, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP 172.67.155.65. It leverages a Let's Encrypt SSL certificate issued post-domain creation on March 20, 2026. This domain remains unlisted in Google Safe Browsing and has not been added to major public blocklists at the time of analysis.


coinbase-accessvault.com is currently flagged as active with elevated risk. Users are advised to avoid interaction and report any exposure to their security teams or service provider. Remaining risk is considered elevated due to the domain’s active status, plausible lures, and potential for continued deployment in phishing campaigns targeting Coinbase customers.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Coinbase

## Domain Intelligence
- Registered: 2026-03-20 16:55:43
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.155.65

## Detection Status
- VirusTotal: 4 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/fbd76a81-445e-4b31-8fdc-e1d597b207ce
- PhishDestroy: https://phishdestroy.io/domain/coinbase-accessvault.com/
- LLM endpoint: https://phishdestroy.io/domain/coinbase-accessvault.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbase-accessvault.com/
Last updated: 2026-03-20