coinbaseapp[.]vercel[.]app

The domain coinbaseapp.vercel.app is currently flagged as a high‑risk brand‑impersonation campaign targeting Coinbase. Analysis indicates the site is actively serving content (HTTP 200) and utilizes a stack that includes Vercel hosting, a React front‑end, and HTTP Strict Transport Security (HSTS). The presence of these technologies aligns with the observed infrastructure and suggests a deliberately crafted environment intended to appear legitimate.

Infrastructure inspection reveals the domain was registered on February 21 2026 through Tucows Domains Inc. DNS resolution points to the IP address 216.198.79.3, which belongs to the Amazon.com, Inc. network (AS16509) and is physically located in the United States. The TLS certificate is issued by Google Trust Services under the WR1 designation, confirming the use of a valid public‑trusted certificate chain. These details corroborate the hosting choices typical of rapid‑deployment phishing kits.

Reputation data shows the domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Independent scoring services assign a low trust rating: Scamadviser reports a score of 41 out of 100, while Gridinsoft rates the domain at 0 out of 100. VirusTotal analysis records three out of ninety‑five security vendors flagging the domain as malicious, providing additional corroboration of its illicit nature. The combined evidence supports a classification of a cryptocurrency‑related brand impersonation scheme.

Defenders should prioritize immediate containment of the domain and its associated IP address. Network‑level blocks, DNS sinkholing, and updating intrusion‑detection signatures to include the domain and its hosting subnet are recommended. End‑user awareness campaigns should remind Coinbase users that any unsolicited request originating from a vercel.app subdomain is unauthorised. Continuous monitoring of related Vercel and Amazon IP ranges can help detect future replicas of this campaign.