coinvault[.]live

The domain coinvault.live is identified as a high-risk brand impersonation threat targeting Coinbase users. Analysis confirms it operates as a phishing site, presenting a fraudulent 'Coinbase Vault' interface to deceive victims into submitting sensitive account credentials. The domain is currently offline but was actively used in malicious campaigns prior to takedown. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameSilo, LLC, and resolved to the IP address 80.78.22.230, hosted on AS39287 (Materialism s.r.l., Denmark). Security assessments indicate 19 of 95 vendors on VirusTotal flagged the domain as malicious, while three independent blocklists included it in their denylists. The site lacked SSL encryption, further increasing exposure risks for visitors. Detection systems such as PhishDestroy, MetaMask, and SEAL had already blocked access, and Google Safe Browsing classified it as a phishing threat. Although coinvault.live is now offline, similar threats may re-emerge under different domains. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on financial platforms, and cross-reference security warnings from browser-based protection systems. Organizations should monitor for newly registered domains mimicking legitimate brands and update blocklists with confirmed malicious indicators, including the IP 80.78.22.230 and the domain creation date.