# vaultonbase.com — SUSPICIOUS

> Stay safe online! The domain vaultonbase.com mimics Coinbase to steal data. Avoid it and verify official URLs before sharing info.

## Summary
PhishDestroy has identified vaultonbase.com as a medium-risk threat due to its role in brand impersonation targeting Coinbase. This domain aims to deceive users by mimicking a trusted cryptocurrency platform, potentially leading to credential theft or financial loss.

The domain vaultonbase.com was registered recently on March 13, 2026, via NiceNIC International Group Co., Limited, and resolves to IP address 216.198.79.1. It displays a convincing page title, "Coinbase - Buy and Sell Bitcoin, Ethereum, and more with trust," designed to lure victims. Although only 3 out of 95 VirusTotal security engines flag this domain, it appears on one security blocklist, which supports its suspicious nature. The domain remains active, increasing the risk to unsuspecting users.

Users should exercise caution by avoiding any interaction with vaultonbase.com and verifying URLs carefully when accessing Coinbase services. Organizations are advised to block this domain at the network level and monitor for related phishing attempts. PhishDestroy continues to track vaultonbase.com’s status to provide timely updates and protect the community from emerging threats.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP 200)
- Target brand: Coinbase
- Page title: Coinbase - Buy and Sell Bitcoin, Ethereum, and more with trust

## Domain Intelligence
- Registered: 2026-03-13 03:07:02
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 216.198.79.1
- IP Org: Cloudflare CDN
- Nameservers: rustam.ns.cloudflare.com sunny.ns.cloudflare.com
- SSL Issuer: Let's Encrypt / R12

## Detection Status
- VirusTotal: 3 vendors flagged
  Vendors: ["Gridinsoft", "SOCRadar", "URLQuery"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce53e-a9bb-7052-8643-49cfc42b8099.png
- PhishDestroy: https://phishdestroy.io/domain/vaultonbase.com/
- LLM endpoint: https://phishdestroy.io/domain/vaultonbase.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/vaultonbase.com/
Last updated: 2026-03-19