access-vault-coinbase[.]com

The domain access-vault-coinbase.com is identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis confirms this domain was designed to deceive users by mimicking Coinbase’s secure vault services, as evidenced by its page title 'coinbase vault.' The domain is currently offline, but prior activity indicates malicious intent. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Name.com, Inc., and resolved to the IP address 34.111.179.208, hosted on Google LLC’s AS396982 network in the United States. Security vendors flagged this domain in 18 of 95 VirusTotal scans, and it appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate was issued by Let’s Encrypt (serial number E8), a common tactic to lend superficial legitimacy to fraudulent sites. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the technical indicators—including the recent creation date, brand impersonation tactics, and security vendor detections—confirm its malicious nature. Organizations and users are advised to block this domain at the network level, monitor for related phishing campaigns, and verify all communications through official Coinbase channels. Security teams should treat any prior interaction with this domain as a potential compromise and conduct forensic analysis if credentials or sensitive data were entered.