coinbase-nine[.]vercel[.]app

The domain coinbase-nine.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and is currently listed as offline. Technical probing shows the host resolves to IP address 216.198.79.131, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WR1 label, indicating that HTTPS is enforced, and the response headers include HTTP Strict Transport Security (HSTS). An HTTP request returns a 404 status code, suggesting that the original content is no longer reachable.

The page title reported by crawlers is "React App," providing no further context about the payload. Detection signals are strong: the domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. Google Safe Browsing has flagged the URL for social engineering, and VirusTotal records 14 of 95 antivirus and URL scanners rating the domain as malicious. The threat classification from the intelligence set is a crypto‑related scam that impersonates the Coinbase brand, aligning with the observed brand target entry.

While the content is not presently accessible, the combination of a brand‑impersonation indicator, a crypto‑scam label, multiple vendor detections, and blocklist presence constitutes high confidence that the site was used for credential harvesting or illicit cryptocurrency activity. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the URL, and update threat intelligence feeds with the observed indicators of compromise (IOC) – including the domain name, hosting IP, TLS certificate issuer, and the 404 response pattern. Ongoing surveillance of related Vercel‑hosted subdomains is recommended, as the infrastructure could be reused for future impersonation campaigns.