coinbase-clones[.]vercel[.]app

This domain, coinbase-clones.vercel.app, is flagged as a high-risk brand impersonation site specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site is designed to deceive users into believing they are interacting with legitimate Coinbase services, likely for credential harvesting or unauthorized transaction initiation. No explicit drainer kit signatures have been identified in initial scans, though the deployment status suggests possible staging or obfuscation techniques to evade detection. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is detected by 12 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it as phishing. The domain was registered through Vercel Inc. on March 06, 2026, and resolves to the IP address 64.29.17.131, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by Google Trust Services under the WR1 intermediate. The domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its fraudulent nature. As of the latest assessment, coinbase-clones.vercel.app remains active, though its page title displays 'Deployment Unavailable,' which may indicate temporary takedown measures or intentional misdirection. Despite its current state, the domain retains significant residual risk due to its verified association with phishing campaigns and its presence on multiple threat intelligence feeds. Users and network administrators are advised to implement immediate blocking at the DNS and IP levels, while security teams should monitor for related infrastructure or newly registered domains leveraging similar naming conventions. Continuous vigilance is recommended, as threat actors frequently rotate domains to sustain their operations.