cubedwebvaultx[.]com

The domain cubedwebvaultx.com was registered on 17 October 2025 through NameSilo, LLC. Its DNS configuration lists four authoritative nameservers: ns17.asurahosting.com, ns17.my-control-panel.com, ns18.asurahosting.com and ns18.my-co. The domain resolves to the IPv4 address 198.251.81.188, which is announced by AS53667 (FranTech Solutions) and geolocated to the United States. No TLS certificate is presented, indicating that the site is served over plain HTTP. The public page title returned from the host is “Home - Cubed Web3 Vault - A crypto buy and sell marketplace”, which aligns with the reported scam type of wallet/seed phishing and the brand impersonation of Coinbase.

Gridinsoft assigns a trust score of 0 / 100, and three of ninety‑five VirusTotal scanners have flagged the domain as malicious. The domain appears on four external security blocklists and has been explicitly blocked by PhishDestroy, Polkadot, Enkrypt and Codeesura. The current operational status is offline, suggesting the phishing campaign has been taken down or is no longer reachable. However, the infrastructure components – the IP address, the hosting provider and the set of nameservers – remain active and could be reused for future campaigns.

Defenders should continue to monitor the IP 198.251.81.188 and the associated ASN for any re‑appearance of malicious content, enforce blocklist updates to include the domain and its nameservers, and consider sink‑holing the address to capture residual traffic. Because the site claims to be a “crypto buy and sell marketplace”, users targeting Coinbase credentials may be lured to enter seed phrases; security awareness messaging should remind users that Coinbase never requests private keys or seed phrases via unsolicited web pages. At this time, no additional technical artifacts such as malware samples or payload URLs have been disclosed, leaving the exact phishing flow uncertain.