# coinbasevaultpro.com — SUSPICIOUS

> Investigators identify coinbasevaultpro.com as a Coinbase impersonation site pushing a crypto drainer. Flagged by 0 of 95 VirusTotal vendors. Block immediately.

## Summary
coinbasevaultpro.com is an active brand impersonation site impersonating the cryptocurrency exchange Coinbase.

PhishDestroy identifies this domain as a Coinbase impersonation campaign currently under investigation. VirusTotal currently flags the site with 0 of 95 vendors detecting the threat. The domain resolves to IP 188.114.97.3, was registered by CNOBIN INFORMATION TECHNOLOGY LIMITED, and was created on April 01, 2026.

This domain leverages a Let's Encrypt SSL certificate to appear legitimate. Current status indicates the threat is active and not yet widely detected. Organizations and users should block coinbasevaultpro.com at network and endpoint levels. Avoid accessing the domain and report indicators to relevant threat intelligence feeds. Implement email filtering rules to block messages referencing the domain.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Coinbase

## Domain Intelligence
- Registered: 2026-04-01 13:55:50
- Registrar: CNOBIN INFORMATION TECHNOLOGY LIMITED
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/10109886-2c67-47c4-b381-6b09ab8e4e23
- PhishDestroy: https://phishdestroy.io/domain/coinbasevaultpro.com/
- LLM endpoint: https://phishdestroy.io/domain/coinbasevaultpro.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbasevaultpro.com/
Last updated: 2026-04-01