activatemycoinbasevault[.]com

The domain activatemycoinbasevault.com was registered on October 8 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the Cloudflare‑owned address 104.21.8.39, ASN 13335, located in the United States. The site presented a TLS certificate identified as “WE1”, indicating the use of a generic or potentially self‑signed certificate. Threat intelligence sources classify the activity as a crypto‑related scam that impersonates the Coinbase brand. The domain appears on a single security blocklist and has a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent.

AlienVault OTX references the domain in one pulse, and PhishDestroy has already taken the site offline. VirusTotal analysis shows that 17 of 93 scanning engines flagged the domain as malicious, reinforcing the suspicion. The evidence suggests the operators leveraged Cloudflare infrastructure to hide the true origin and to benefit from a reputable network. Because the site is currently offline, immediate impact is limited, but the registration date and rapid appearance on blocklists indicate a short‑lived campaign targeting Coinbase users with a cryptocurrency‑draining lure.

No publicly available page title or content snapshot was captured before takedown, so the exact lure used remains unknown. The lack of a captured page snapshot prevents confirmation of the specific wording used to lure victims, but the classification as a Coinbase impersonation crypto scam is supported by the brand reference in the domain name and the threat‑type label. Defenders should continue to block the domain and its resolved IP at perimeter defenses, monitor for any new sub‑domains or similar registrars that repeat the “activatemycoinbasevault” naming pattern, and update detection rules to flag any HTTP requests containing the “coinbasevault” keyword. Analysts should also correlate any inbound traffic to the 104.21.8.