safetyvault-coinbase[.]com

Analysis on safetyvault-coinbase.com shows a short‑lived infrastructure that was actively used for a crypto‑related brand impersonation campaign targeting Coinbase users. The domain was registered on 15 October 2025 through Dominet (HK) Limited and is hosted on Cloudflare’s network (ASN 13335) with the IP address 185.158.133.1, which resolves to a location in Poland. The authoritative nameservers are dylan.ns.cloudflare.com and fiona.ns.cloudflare.com, and the site did not present an SSL certificate, indicating that HTTPS was not enforced. HTTP responses returned a page with the title “Boom.”, which is the only observable content disclosed by the provided intelligence.

The site was flagged by 16 of 95 vendors on VirusTotal, and it appears on two external security blocklists. Independent blocklist operators PhishDestroy and CryptoFirewall have also listed the domain as malicious. Gridinsoft assigned a trust score of 0 / 100, and AlienVault OTX references the domain in six separate threat‑intel pulses, reinforcing the consensus that the domain was used for malicious purposes. The domain’s current status is offline, preventing further live interaction, but historical evidence suggests it was employed in a crypto‑scam that leveraged Coinbase’s brand to lure victims.

Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any resurgence of the same registrar or hosting patterns. Because the site lacked TLS, any future re‑use would be trivially detectable through certificate‑absence checks. Analysts should also watch for similar domain names that combine “vault” or “safety” with the Coinbase brand, as the naming convention appears to be part of a broader impersonation tactic. The limited visibility of the payload – only the page title is known – means that additional forensic collection would be required to identify the exact phishing or malware delivery mechanisms, should the infrastructure reappear.