cryptovault[.]site

The domain cryptovault.site was a phishing site engaged in brand impersonation targeting Coinbase users. It posed an elevated risk by mimicking the cryptocurrency exchange to deceive victims into disclosing login credentials or sensitive information, though no drainer kit was detected. As of the latest verification, cryptovault.site has been taken offline.

Technical indicators confirm its malicious intent: 1 of 95 VirusTotal security vendors flagged the domain, while Google Safe Browsing did not detect it. The domain was registered through Go Daddy, LLC on June 9, 2025, and resolved to the IP address 76.223.105.230, hosted on Amazon.com, Inc.'s infrastructure (AS16509). It appeared on one security blocklist (PhishDestroy) and used an SSL certificate issued by GoDaddy.com, Inc. The observed page title was 'Crypto News,' and technologies such as GoDaddy Website Builder and RequireJS were detected. Gridinsoft assigned a trust score of 0/100, while Scamadviser rated it 25/100.

Victims of cryptovault.site should immediately change any compromised passwords, enable two-factor authentication (2FA) on their Coinbase accounts, and monitor for unauthorized transactions. If cryptocurrency was involved, revoking token approvals and transferring funds to a new wallet is recommended. Report the domain to Coinbase's security team and file complaints with platforms like the FBI's IC3 (Internet Crime Complaint Center) or local cybercrime units. Additionally, submit the domain to threat-sharing communities such as PhishTank or URLVoid for broader awareness.