coin-base-live-market[.]vercel[.]app

This domain, coin-base-live-market.vercel.app, is identified as a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to mimic legitimate Coinbase services, likely to deceive users into divulging sensitive credentials or executing unauthorized transactions. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with known brand impersonation tactics used to facilitate credential theft or fraudulent account access. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on February 21, 2026, through Tucows Domains Inc., and resolves to the IP address 216.198.79.3, hosted on Amazon.com, Inc. infrastructure (AS16509). Google Safe Browsing flags the domain as phishing, and 18 out of 95 security vendors on VirusTotal detect it as malicious. The domain appears on two security blocklists, and its SSL certificate is issued by Google Trust Services (WR1). The page title, Deployment Unavailable, suggests the site may have been taken down or is temporarily disabled, potentially to evade detection. As of the latest assessment, the domain is offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for similar malicious activities. Users who may have interacted with this domain should immediately revoke any active sessions, reset credentials, and monitor accounts for unauthorized transactions. Organizations are advised to block the domain and associated IP address at the network level to prevent potential re-emergence. The high-risk classification persists due to the domain's history and the likelihood of future malicious reuse.