coinbaase[.]vercel[.]app

The domain coinbaase.vercel.app was registered on 2026-02-21 via Tucows Domains Inc. It resolves to IP 216.198.79.195, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site served an HTTP 451 response and presented a TLS certificate issued by Google Trust Services under the WR1 intermediate, indicating a valid HTTPS endpoint. The page title returned by the server is “React App”, and the underlying technology stack includes Vercel hosting with HTTP Strict Transport Security enabled. Security telemetry shows the domain is flagged by Google Safe Browsing for social engineering, appears on one public blocklist, and has been blocked by the PhishDestroy sinkhole.

VirusTotal analysis recorded 12 detections out of 93 scanned engines, confirming malicious classification. The domain is explicitly associated with a brand impersonation campaign targeting Coinbase, as indicated by the intelligence tag. The current operational status is offline, suggesting the hosting has been taken down or the site is no longer serving content. However, the underlying infrastructure – a Vercel instance on a shared Amazon IP – remains reusable, and the registration details are still active, meaning the threat actor could redeploy the domain or create similar clones.

Defenders should add the domain and its IP to blocklists, monitor for any re‑registration or new DNS records pointing to the same address, and enforce strict email and web filtering for URLs containing “coinbaase”. Continuous observation of Google Safe Browsing and VirusTotal updates is advised to capture any re‑emergence. At present, no additional content or login page has been captured, so the exact phishing vector remains unknown; further collection of page snapshots would be required to confirm the lure used against Coinbase users.