mysafevault-coinbase[.]com

This domain, mysafevault-coinbase.com, is identified as a brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site mimics the legitimate Coinbase sign-in interface, presenting a high-fidelity replica of the official login page to deceive users into submitting credentials. No crypto drainer kit signatures were explicitly detected, but the credential theft framework aligns with common phishing toolkits designed to harvest sensitive account information. Infrastructure analysis reveals multiple concrete indicators of compromise. The domain was registered through Dominet (HK) Limited on October 26, 2025, and resolves to the IP address 185.158.133.1, hosted under AS13335 (Cloudflare, Inc.) in Poland. Security vendor assessments on VirusTotal flag the domain as malicious, with 18 out of 95 engines detecting it. The domain appears on two security blocklists, and no SSL certificate was observed, further degrading its legitimacy. Google Safe Browsing status was not explicitly provided, but the absence of encryption and the use of a recently registered domain are consistent with fraudulent activity. The domain has since been taken offline, reducing immediate exposure to end users. However, residual risk persists due to the potential reuse of infrastructure or registration of similar domains by the same threat actor. Response actions likely included registrar enforcement or hosting provider takedown, though no specific remediation details were disclosed. Users who may have interacted with the domain are advised to rotate credentials immediately, enable multi-factor authentication on all financial accounts, and monitor for unauthorized transactions. Organizations should update blocklists with the domain and associated IP to prevent future access attempts.