cb[.]redpackets[.]xyz

Analysis of the domain cb.redpackets.xyz confirms its classification as an active cryptocurrency phishing site targeting Coinbase users. Registered on February 21, 2026, through Name.com, Inc., the domain resolves to IP address 216.198.79.65, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The nameservers ns1.vercel-dns.com and ns2.vercel-dns.com indicate deployment on Vercel's platform, a common choice for rapidly spun-up phishing pages due to its ease of use and free hosting options. The page title 'Red Packets on Base | Coinbase' directly references Coinbase's branding and the Base blockchain, suggesting an attempt to impersonate Coinbase's legitimate promotional or reward campaigns. The domain currently returns an HTTP 200 status, signaling an operational endpoint, and employs a Let's Encrypt SSL certificate (R13), which provides an illusion of legitimacy to unsuspecting visitors. HSTS is also detected, though this security header is often misconfigured or irrelevant in phishing contexts where the goal is to harvest credentials rather than secure them. As of July 12, 2026, the domain remains active and is flagged by at least one security blocklist, with PhishDestroy explicitly listing it as malicious. VirusTotal reports that 9 out of 93 security vendors detect the domain as harmful, a detection rate consistent with confirmed phishing infrastructure. No evidence suggests takedown efforts have been initiated by the registrar or hosting provider. Defenders should treat this domain as high-risk and prioritize blocking it at the network and endpoint levels. Given the use of Vercel's nameservers, monitoring for newly registered domains under vercel-dns.com may help identify related campaigns. The domain's registration age (less than five months) and its association with a known cryptocurrency scam type further justify immediate containment actions.