coinbase-clone-ruddy[.]vercel[.]app

PhishDestroy identifies coinbase-clone-ruddy.vercel.app as an active crypto drainer campaign impersonating the cryptocurrency exchange Coinbase. The domain employs a visually deceptive replica of Coinbase’s login portal to trick users into connecting cryptocurrency wallets, triggering unauthorized token transfers to attacker-controlled addresses. While no public drainer kit hash is currently associated with this domain, the infrastructure and social engineering tactics align with known malicious wallet drainer services operating in the wild.

This domain was flagged by PhishDestroy with 11 out of 95 security vendors on VirusTotal detecting malicious intent. It was registered through Vercel Inc. and resolves to IP address 216.198.79.3. The domain carries a Google Trust Services SSL certificate and is flagged by Google Safe Browsing under the category "SOCIAL_ENGINEERING," indicating confirmed deception-based threats. At present, no public record of creation date is available due to Vercel’s privacy protections, but the presence of a live drainer page and active detection by multiple security platforms confirms recent deployment.

The domain remains ACTIVE as of the latest scan. PhishDestroy recommends immediate blocking of the domain and IP, and advises users to verify any unsolicited Coinbase communications via official channels. While the risk is high due to successful detections and confirmed malicious behavior, the domain’s reliance on Vercel hosting may limit takedown speed. Users should exercise extreme caution when encountering links resembling this domain or any Coinbase impersonation. Remaining risk includes continued phishing distribution and potential evolution into new drainer variants.