coinbasewalletbeta[.]vercel[.]app

The domain coinbasewalletbeta.vercel.app was registered on 21 February 2026 through Tucows Domains Inc. The site resolved to the IP address 216.198.79.67, which is hosted by Amazon.com, Inc. (AS16509) in the United States. A TLS certificate issued by Google Trust Services under the WR1 designation was present, indicating a valid HTTPS endpoint, and the server advertised HTTP Strict Transport Security. The HTTP response returned status code 451, suggesting the content was unavailable for legal reasons, and the domain is currently listed as offline. Public threat intelligence shows the page title “Coinbase Wallet Beta: Everything You Need to Know”, which directly references the Coinbase brand. The domain is classified as a crypto‑scam that impersonates Coinbase.

It appears on a single security blocklist and is blocked by the PhishDestroy service. VirusTotal analysis recorded three detections out of ninety‑three scanners, confirming that at least a subset of security products consider the domain malicious. Infrastructure observations indicate the use of Vercel as the underlying hosting platform, a common choice for rapid deployment of fraudulent pages. The combination of a reputable SSL certificate, legitimate‑looking title, and use of a major cloud provider is typical of high‑confidence brand‑impersonation campaigns designed to bypass automated filters. Uncertainties remain regarding the precise content that was served before the takedown, as the site is no longer reachable.

No additional indicators such as phishing URLs, payload hashes, or email distribution patterns have been disclosed. Consequently, defenders cannot evaluate the full scope of victim exposure beyond the observed branding and hosting characteristics.