coinbase-intent-onramp[.]vercel[.]app

coinbase-intent-onramp.vercel.app is currently active and resolves to IP 216.198.79.67, which belongs to AS16509 Amazon.com, Inc. located in the United States. The domain was registered on February 21, 2026 through Tucows Domains Inc. and is hosted on the Vercel platform, employing HSTS and presenting a Google Trust Services / WR1 SSL certificate. Google Safe Browsing classifies the site under the “SOCIAL_ENGINEERING” category, and VirusTotal records 16 of 93 security vendors flagging the domain. The page title “Coinbase Onramp & Offramp Demo” and the declared brand target “coinbase” indicate a brand‑impersonation attempt aimed at a crypto‑related scam. The site returns HTTP 200 and appears on one public blocklist, presently blocked by PhishDestroy. Infrastructure analysis shows no additional services beyond the primary web server, and the limited detection footprint suggests a focused campaign rather than a widespread distribution network. Defenders should add the domain and its resolved IP to blocklists, monitor DNS queries for similar Vercel‑hosted subdomains, and enforce endpoint protections that reference the Google Safe Browsing flag. Ongoing observation is recommended to detect any evolution of the payload or credential‑harvesting mechanisms that may be introduced on the site.