web3assetvaults[.]com

On July 12, 2026, the domain web3assetvaults.com was identified as an active threat engaged in brand impersonation, specifically targeting Coinbase. The domain, created on October 17, 2025, has been flagged by several security vendors and appears on multiple blocklists, indicating a high risk level. The page title, 'Home - Web3assetvault - A crypto buy and sell marketplace,' suggests that the website is designed to appear as a legitimate crypto trading platform, which aligns with the reported scam type of cryptocurrency. The domain resolves to the IP address 107.172.61.186, located in the United States and hosted by the AS36352 network, commonly associated with HostPapa. Infrastructure analysis reveals that the domain is managed through Sav.com, LLC, and utilizes nameservers ns1.korrectserver.com and ns2.korrectserver.com. The domain is currently active and has been blocked by notable security platforms such as PhishDestroy and Polkadot, further confirming its malicious nature. The site employs LiteSpeed web server technology and Alpine.js for dynamic content, and uses HTTP/3 for improved performance. The SSL certificate is issued by Let's Encrypt, which is a common practice for both legitimate and malicious sites. Despite the Gridinsoft trust score of 1/100, which is extremely low, the exact content of the site has not been fully analyzed. However, the high number of security vendors (5 out of 95) flagging this domain and its presence on multiple blocklists indicate that it poses a significant threat to users. Defenders are advised to monitor and block traffic to this domain immediately, as it is actively involved in impersonating Coinbase and could lead to financial losses or credential theft. Additional investigation into the site's content and activity patterns is recommended to understand the full scope of the threat and to implement more targeted defenses.