coinbase-silk[.]vercel[.]app

Analysis of coinbase-silk.vercel.app shows a newly created domain (registered 21 Feb 2026 via Tucows Domains Inc.) that leverages Vercel’s hosting platform and enforces HTTP Strict Transport Security. The site resolves to IP 216.198.79.195, an address owned by Amazon.com, Inc. (AS16509) and located in the United States. TLS termination is provided by a Google Trust Services certificate issued to “WR1”, indicating the use of Google’s managed SSL service. An HTTP 451 response and the page title “Deployment Unavailable” suggest that the site has been taken offline, possibly due to a takedown request.

Despite the offline status, the domain is actively listed on multiple defensive feeds. Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has added it to its blocklist; a second unnamed security blocklist also contains the domain. VirusTotal reports that 10 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. The threat profile is identified as a brand‑impersonation campaign targeting Coinbase and is labeled a crypto‑scam, indicating that the site likely attempted to lure victims into disclosing cryptocurrency credentials or transferring funds.

Evidence does not include a captured landing page or malware sample, so the exact payload and user‑interaction flow remain unknown. Nevertheless, the combination of registrar data, hosting details, SSL provenance, and multiple threat‑intelligence indicators provides a high‑confidence assessment that the domain was used for fraudulent purposes. Defenders should block the domain at DNS and proxy layers, monitor the associated IP range for any resurgence of malicious Vercel subdomains, and incorporate the indicator set (domain, IP, SSL fingerprint) into existing security controls. Continuous observation of the registrar’s future registrations and of Vercel‑hosted assets is advised to detect similar impersonation attempts promptly.