coinbase-clone-eight[.]vercel[.]app

Analysis identifies coinbase-clone-eight.vercel.app as an active brand impersonation phishing domain targeting Coinbase, designed to mimic legitimate authentication flows and harvest user credentials. The infrastructure indicates a high-confidence phishing operation leveraging cloned branding elements to deceive users into submitting sensitive account information.

Technical indicators show the domain was created on February 21, 2026 and resolves to IP 216.198.79.3 hosted in the United States under AS16509 Amazon.com, Inc. Registration is through Tucows Domains Inc. The SSL certificate is issued via Google Trust Services (WR1). The domain is flagged by Google Safe Browsing as phishing and appears on 2 security blocklists including PhishDestroy and Enkrypt. VirusTotal telemetry reports 14/95 security vendors classify the domain as malicious, confirming multi-engine detection consensus.

The domain remains active, indicating ongoing exposure risk to end users. Given confirmed Coinbase impersonation and persistent hosting infrastructure, immediate defensive actions are recommended including DNS and IP blocking, threat feed ingestion, and user awareness controls. Security monitoring should focus on related Vercel-hosted subdomains and credential harvesting pages. Continued access presents high risk of account compromise and credential leakage.