coinbases-two[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site is designed to deceive users into believing they are interacting with an official Coinbase Rewards Dashboard, potentially leading to unauthorized access to sensitive account information or financial assets. The threat type is classified as brand impersonation, a tactic commonly used to exploit user trust in established brands for fraudulent purposes.

Infrastructure analysis reveals multiple concrete indicators of compromise. The domain coinbases-two.vercel.app resolves to the IP address 216.198.79.3 and is registered through Vercel Inc. It appears on one security blocklist and is actively blocked by OpenPhish. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious. Google Safe Browsing has classified the domain under the SOCIAL_ENGINEERING category, further corroborating its deceptive nature. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the domain's fraudulent intent. The page title, Coinbase Rewards Dashboard, directly mimics official Coinbase branding to enhance credibility.

To mitigate risks associated with this brand impersonation threat, users and organizations should immediately block access to the domain and its associated IP address. Security teams are advised to monitor for any attempts to access this domain within their networks and to educate users about the dangers of brand impersonation, particularly in the context of cryptocurrency platforms. Multi-factor authentication should be enforced for all accounts to reduce the risk of unauthorized access. Additionally, domain registrars and hosting providers should be notified of the fraudulent activity to facilitate takedown procedures. Regular audits of security blocklists and threat intelligence feeds are recommended to stay updated on emerging threats.