v0-coinbase-clone-lovat[.]vercel[.]app

Analysis of v0-coinbase-clone-lovat.vercel.app indicates an active brand‑impersonation campaign targeting Coinbase users. The site returns HTTP 200 and resolves to IP 64.29.17.67, an address owned by Vercel, Inc., located in the United States. The domain was registered on 13 September 2025 through Vercel Inc. and presents a TLS certificate issued by Google Trust Services (WR1), suggesting a legitimate‑looking HTTPS connection. Google Safe Browsing classifies the URL under the SOCIAL_ENGINEERING category, and VirusTotal records 14 detections out of 91 scanners, reinforcing the malicious assessment. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Page metadata reveals a title of “Help Center – Coinbase,” confirming the intent to masquerade as an official Coinbase resource. Infrastructure signals such as the missing nameserver information (NS_NOT_FOUND) and a Gridinsoft trust score of 0 / 100 further indicate a low‑quality, likely automated deployment. While the exact phishing page content has not been examined, the convergence of brand‑impersonation indicators, blocklist presence, and security vendor alerts warrants a high‑risk classification. Defenders should block the domain at network perimeters, update URL filtering and email security policies, monitor for related traffic to the associated IP, and advise users to avoid any unsolicited links purporting to be Coinbase support. Continuous re‑assessment is advised as additional intelligence may emerge.