v0-coinbasevaultsetup[.]vercel[.]app

The domain v0-coinbasevaultsetup.vercel.app was observed delivering a brand‑impersonation payload that mimics Coinbase’s Vault service. DNS resolution points to the IP address 216.198.79.67, which is registered to Amazon.com, Inc. (AS16509) and geolocated in the United States. The site is hosted on Vercel infrastructure, as indicated by the “Vercel” technology fingerprint and the presence of an HSTS header. SSL termination is provided by Google Trust Services under the WR1 certificate chain, confirming that a valid public certificate is in use. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 12 of 95 scanning engines flag the domain as malicious, reflecting a moderate to high confidence of abuse.

The domain appears on a single external blocklist and has been actively blocked by PhishDestroy, reinforcing its malicious reputation. An HTTP 451 response code was returned at the time of testing, indicating that the resource is unavailable for legal reasons, consistent with the current offline status. The page title “Coinbase Vault” aligns with the declared brand target of Coinbase and the listed scam type of “Crypto Scam”. Registration information shows the domain was provisioned through Vercel Inc., a legitimate SaaS provider, which does not imply endorsement of the content.

No further content analysis is available because the site is offline. Defenders should add 216.198.79.67 to network‑level deny lists, enforce DNS filtering for the full domain, and monitor for any future re‑registration on similar Vercel sub‑domains. Continuous observation of Google Safe Browsing and VirusTotal alerts is recommended to capture any resurgence. Organizations that use Coinbase services should educate users about unsolicited requests that reference a “Vault” and verify URLs against the official Coinbase domain before entering credentials.