coinbase-navy-two[.]vercel[.]app

Analysis of the domain coinbase-navy-two.vercel.app confirms its classification as a high-risk phishing site targeting Coinbase users, as documented on July 23, 2026. The domain was registered through Tucows Domains Inc. on February 21, 2026, and resolves to the IP address 216.198.79.195, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Google Trust Services under the identifier WR1, a common provider for both legitimate and malicious sites, offering no definitive trust signal on its own. At the time of assessment, the domain was flagged by one security blocklist and detected by 16 of 93 security vendors on VirusTotal, indicating moderate but not universal recognition as malicious.

Google Safe Browsing has classified the domain under social engineering, reinforcing its role in fraudulent activity. The HTTP status code 451 (Unavailable for Legal Reasons) and the page title 'Deployment Unavailable' suggest the site may have been taken down or restricted, though this does not preclude prior malicious use. The domain employs Vercel hosting and implements HTTP Strict Transport Security (HSTS), a security feature that, while beneficial in legitimate contexts, is also leveraged by threat actors to lend an appearance of legitimacy. The scam type is explicitly identified as a crypto scam, aligning with the impersonation of Coinbase, a major cryptocurrency exchange platform.

Defenders should treat this domain as confirmed malicious infrastructure. Network-level blocking is recommended, particularly for financial and cryptocurrency-related services. Security teams are advised to review logs for connections to 216.198.79.195 and the domain itself, as well as monitor for related subdomains or newly registered lookalike domains under the Vercel platform. Given the domain's offline status, further forensic analysis may be limited, but historical activity should be investigated for potential compromise indicators.