coinbase-clone-app[.]vercel[.]app

This domain, coinbase-clone-app.vercel.app, is flagged as a high-risk brand impersonation threat specifically targeting Ethereum users. Analysis indicates the site mimics legitimate cryptocurrency wallet interfaces, likely deploying a crypto drainer kit to siphon digital assets from victims. The domain impersonates the Ethereum ecosystem, exploiting user trust in established brands to facilitate unauthorized transactions or credential theft. Infrastructure analysis reveals the following technical indicators: the domain is detected by 18 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging it as phishing. It appears on one security blocklist and is registered through Tucows Domains Inc., with a creation date of February 21, 2026. The domain resolves to the IP address 216.198.79.195, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Google Trust Services under the identifier WR1. As of the latest assessment, the domain remains active and unmitigated, posing a continued risk to users. While it is blocked by at least one security provider, the low detection rate among vendors suggests the campaign may still evade some defenses. Users are advised to avoid interacting with the domain, revoke any connected wallet permissions, and verify all transaction requests through official channels. Organizations should update blocklists to include this domain and its associated IP address to prevent further exploitation.