createvault-coinbase[.]com

Analysis of createvault-coinbase.com indicates a credential‑harvesting infrastructure that impersonates Coinbase. The domain was registered on 24 August 2025 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 65.87.7.64, which is announced by AS215659 (Aokigahara SRL) in the United States. No TLS certificate is deployed, so all HTTP connections are unencrypted and the site cannot benefit from HSTS or certificate‑pinning mechanisms. The HTTP response carries the page title “Coinbase Vault”, matching the declared brand target of Coinbase and confirming a brand‑impersonation intent. VirusTotal has recorded 18 of 95 scanning engines flagging the domain as malicious, and the address appears on a single external blocklist.

AlienVault OTX references the domain in sixteen threat‑intel pulses, and the domain is also listed as blocked by PhishDestroy. Current probing shows the host is offline, which may indicate a takedown or temporary suspension. The registrar, NiceNIC, is a known bulk registrar, and the presence of only one nameserver suggests a minimal hosting footprint without CDN or additional infrastructure. The domain does not appear in major safe‑browsing lists beyond the one blocklist, indicating limited exposure in public filters.

Defenders should add the FQDN and its IP 65.87.7.64 to URL filtering, endpoint allow‑list exclusions, and DNS sinkhole rules. Monitoring for new subdomains registered with the same registrar or hosted on the same ASN is advisable, as threat actors often recycle infrastructure. Because the site lacks SSL, any accidental user interaction would expose credentials over cleartext, reinforcing the need for user education about unsolicited “Vault” communications from Coinbase. At present, no further content analysis is available, so the full payload and credential‑capture mechanisms remain unknown.