# coinbasecryptovault.cam — SUSPICIOUS

> coinbasecryptovault.cam mimics Coinbase in a cryptocurrency wallet scam. Detected by PhishDestroy. Check the full report.

## Summary
PhishDestroy identifies coinbasecryptovault.cam as an active brand impersonation domain targeting Coinbase users. This domain masquerades as a legitimate cryptocurrency vault service to deceive victims into divulging sensitive credentials or transferring funds. The threat remains under investigation but exhibits multiple red flags consistent with financial phishing campaigns.

This domain was flagged with a risk level of under_investigation due to its recent creation on March 19, 2026, and its use of a Let's Encrypt SSL certificate to appear legitimate. VirusTotal currently shows 0/95 detections, indicating it remains undetected by most antivirus engines. The domain is registered through Global Domain Group LLC and resolves to IP 216.198.79.1. Notably, no entries were found on major blocklists or threat intelligence feeds at the time of analysis, highlighting the need for proactive monitoring.

To mitigate risks associated with this domain, organizations and users should immediately block the domain and IP address (216.198.79.1) at the network and endpoint levels. Users interacting with cryptocurrency platforms should verify URLs for subtle misspellings or unusual top-level domains (TLDs) like .cam. Additionally, enabling multi-factor authentication (MFA) and educating employees or customers about brand impersonation tactics can reduce exposure to such threats. Security teams are advised to monitor for additional domains registered by Global Domain Group LLC or associated with this campaign.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Coinbase

## Domain Intelligence
- Registered: 2026-03-19 14:06:29
- Registrar: Global Domain Group LLC
- IP: 216.198.79.1

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/61eb0830-d09b-444d-a5c7-54b4d3d186c0
- PhishDestroy: https://phishdestroy.io/domain/coinbasecryptovault.cam/
- LLM endpoint: https://phishdestroy.io/domain/coinbasecryptovault.cam/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbasecryptovault.cam/
Last updated: 2026-03-21