chainvault[.]codewebdemos[.]sbs

This investigation into www.chainvault.codewebdemos.sbs reveals an elevated risk level due to its specific threat type: brand impersonation targeting cryptocurrency users. The domain masquerades as a legitimate vault service to harvest credentials or seed phrases, a common tactic in crypto drainer campaigns. Though currently offline, its recent history and technical indicators warrant caution.

The domain was created on October 26, 2025, via Dynadot LLC, and resolved to IP 198.251.84.200. VirusTotal flagged it with 3 out of 95 security vendors marking it as malicious. It appears on one security blocklist and uses a Let's Encrypt SSL certificate (R12), which is typical for low-cost phishing setups. These data points collectively indicate a short-lived but active campaign.

Users should avoid any interaction with this domain, even if it reappears under a different IP. For crypto users, enable two-factor authentication on all exchange and wallet accounts, never enter seed phrases on websites, and report any unsolicited links to chainvault-related services to the legitimate brand's security team. Monitor accounts for unauthorized transactions and consider using hardware wallets for high-value assets.