coinbase-login-support[.]vercel[.]app

Analysis of coinbase-login-support.vercel.app confirms it as a crypto-focused phishing domain targeting Coinbase users. The domain, registered on February 21, 2026, through Tucows Domains Inc., resolves to IP 216.198.79.195 (AS16509, Amazon.com, Inc., US-based infrastructure). At the time of assessment, the site returns an HTTP 451 status with the page title 'Deployment Unavailable,' indicating it may have been taken offline or is temporarily disabled. Despite this, infrastructure analysis reveals persistent risks: the domain appears on one security blocklist (PhishDestroy), and 11 of 93 security vendors on VirusTotal flagged it as malicious prior to its current offline status.

The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the threat, as phishing sites commonly use valid certificates to appear legitimate. Technologies detected include Vercel hosting and HSTS enforcement, suggesting the attackers leveraged modern web infrastructure to deploy the scam. The scam type is explicitly classified as a crypto scam, aligning with the impersonation of Coinbase, a major cryptocurrency exchange.

Defenders should treat this domain as compromised and maintain blocklist entries, as historical detections and hosting patterns indicate a high likelihood of re-emergence. No evidence of active content or user interaction is currently available, but prior detections and the use of brand impersonation justify elevated risk classification. Organizations should monitor for DNS reactivation or shifts to new hosting providers, as phishing campaigns often reuse infrastructure.