coinbase-cloned-alpha[.]vercel[.]app

coinbase-cloned-alpha.vercel.app has been identified as an active brand impersonation scam targeting Coinbase users. The domain mimics the legitimate Coinbase platform to deceive victims into revealing sensitive information or transferring cryptocurrency assets. PhishDestroy has classified this domain as a high-risk threat under active investigation, with confirmed impersonation tactics employed to exploit user trust in the Coinbase brand.

Analysis of this domain reveals several concerning indicators. Flagged by 10 of 95 VirusTotal vendors, it currently evades detection mechanisms despite its malicious intent. The domain is registered through Vercel Inc. and resolves to IP address 64.29.17.3. It utilizes a Google Trust Services SSL certificate, further enhancing its appearance of legitimacy. While the exact creation date remains undisclosed, the absence of detections underscores the sophistication of this impersonation scheme, posing a significant risk to unsuspecting users.

The domain remains active and poses an immediate threat to potential victims. PhishDestroy recommends blocking coinbase-cloned-alpha.vercel.app at the network and endpoint levels, updating DNS filtering rules, and educating users about the risks of brand impersonation scams. Organizations should also monitor for related domains and review SSL certificate issuance logs for similar threats. Immediate action is critical to mitigate the risk of cryptocurrency theft and credential compromise.