onramp-asset-availability[.]vercel[.]app

The domain onramp-asset-availability.vercel.app is currently active and classified as a high‑risk brand‑impersonation campaign targeting Coinbase. Infrastructure analysis shows the domain resolves to IP 64.29.17.131, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The domain was registered on 23 October 2025 through Vercel Inc., and the hosting environment reports Vercel technology alongside enforced HSTS. TLS is provided by Google Trust Services under the WR1 certificate, indicating a valid HTTPS endpoint. VirusTotal scans have recorded four detections out of ninety‑five vendors, and the domain appears on a single security blocklist and is actively blocked by PhishDestroy. The page title returned by the server is "Coinbase Onramp Asset Availability," reinforcing the intent to mimic a legitimate Coinbase service. Gridinsoft assigns a trust score of 0 / 100, reflecting a lack of reputation. While the observable metadata confirms the presence of brand‑impersonation infrastructure, the specific content served to victims has not been publicly disclosed, leaving the exact user‑experience unknown. Defenders should prioritize immediate blocking of the domain and its associated IP address, add the host to internal blocklists, and monitor for any related indicators such as the Vercel hosting pattern or the specific page title. Continuous surveillance of traffic to the IP and periodic re‑scans are advised to detect any evolution of the campaign.