coinbase-rho[.]vercel[.]app

The domain coinbase-rho.vercel.app was registered on 21 Feb 2026 via Tucows Domains Inc. It resolves to IP 216.198.79.3, which belongs to AS16509 (Amazon.com, Inc.) and is geolocated in the United States. The site presents a TLS certificate issued by Google Trust Services under the WR1 designation, indicating a valid HTTPS configuration. Automated analysis identified the use of Vercel hosting, a React front‑end framework, and HTTP Strict Transport Security (HSTS). VirusTotal scans show 4 of 93 security vendors flag the domain as malicious. The domain appears on two public blocklists and is currently blocked by PhishDestroy and Enkrypt. Gridinsoft assigns a trust score of 0 / 100, while Scamadviser reports 41 / 100, reflecting a low reputation. HTTP requests return status code 402, consistent with reported crypto‑scam activity. The exact page content and lure techniques have not been captured, so the specific malicious payload remains uncertain. Defenders should block traffic to the domain and its underlying IP, add the host to DNS sinkhole lists, monitor for outbound connections to the IP range, and update detection signatures to include the observed TLS fingerprint and the Vercel/React stack indicators.