secureseedvault[.]com

Analysis of secureseedvault.com indicates a deliberately crafted brand‑impersonation campaign targeting Coinbase users. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is presently taken offline. DNS resolution points to the IP address 162.213.255.40, which belongs to the Namecheap, Inc. network (AS22612) located in the United States. The domain uses the name‑servers dns1.namecheaphosting.com and dns2.namecheaphosting.com, both typical of generic hosting services.

No TLS certificate was observed, confirming that HTTPS is not available for the site. A scan on VirusTotal recorded six detections out of ninety‑three security engines, and the Gridinsoft trust score is 0 / 100, indicating a high likelihood of malicious intent. The site’s technology fingerprint includes LiteSpeed web server, Alpine.js front‑end framework, and the Sectigo certificate authority, suggesting a typical low‑cost hosting stack. The page title returned by the server reads “Home – SecureSeedvault – A crypto buy and sell marketplace,” which aligns with the listed scam type of wallet/seed phishing.

The domain appears on four independent blocklists and is explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing the assessment of malicious activity. Although the site is no longer reachable, the combination of recent registration, lack of encryption, low trust score, multiple vendor detections, and blocklist listings provides concrete evidence of a credential‑harvesting operation aimed at Coinbase users. Defenders should continue to block the domain at network perimeter, monitor the hosting provider’s IP range for related activity, and advise users to verify the authenticity of any Coinbase‑related communications. Further investigation could focus on any residual DNS cache entries or archived content to extract phishing payloads, but current data already substantiates the elevated risk classification.