coinbase-archive[.]vercel[.]app

This report details a malicious domain, coinbase-archive.vercel.app, which was designed to impersonate the Coinbase brand as a cryptocurrency scam. The site presented itself with the page title "Coinbase Help," aiming to deceive users into believing it was an official Coinbase support portal. The primary threat was social engineering, as the domain was designed to harvest credentials or sensitive information from Coinbase users by mimicking a legitimate help resource.

Technical analysis confirms the site’s malicious nature. VirusTotal detected the domain by 14 out of 95 security vendors. The domain was flagged by multiple security platforms, including ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, and CyRadar. Google Safe Browsing explicitly flagged the site for SOCIAL_ENGINEERING. The domain was registered through Vercel Inc., hosted on IP address 64.29.17.195 (United States), which is assigned to AS16509 Amazon.com, Inc. SSL certification was provided by Google Trust Services / WR1. Nameservers were ns1.vercel-dns.com and ns2.vercel-dns.com. The domain is currently listed on 1 blocklist.

As of this report, the domain status is DOWN or OFFLINE, indicating it is no longer accessible. The risk level is assessed as high due to the confirmed social engineering threat and the impersonation of a major financial brand, though the immediate risk is mitigated by the site’s inactive state. Users who may have previously interacted with this domain should monitor their accounts for unauthorized activity.