coinbasepro-login-auth[.]created[.]app

Analysis of coinbasepro-login-auth.created.app as of 23 July 2026 indicates the site was deliberately registered to imitate the Coinbase brand. The domain was created on 12 July 2023 through Tucows Domains Inc., and resolves to the IP address 216.150.1.129, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States. DNS resolution is handled by ns1.vercel-dns.com and ns2.vercel-dns.com, reflecting deployment on the Vercel platform. The site served an HTTPS certificate issued by Let’s Encrypt (R13), with HTTP Strict Transport Security enabled, and leveraged Google Cloud CDN, Google Cloud services, and LaunchDarkly for feature flagging. The page title returned by the server reads “Coinbase Pro Login - Access Advanced Cryptocurrency Trading Platform”, confirming a targeted impersonation of Coinbase’s professional trading interface.

Security assessments show mixed detection. Google Safe Browsing classifies the domain as social engineering, and VirusTotal records 15 positive detections out of 95 scanned scanners. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Despite these indicators, the HTTP response currently returns a 404 status, and the domain is listed as offline, suggesting that the phishing infrastructure has been taken down or is temporarily inactive.

The available evidence points to a cryptocurrency‑focused scam, as indicated by the “Crypto Scam” label in the intelligence feed. However, no detailed payload, credential‑harvesting page, or malware sample has been captured, leaving the exact attack vector uncertain. Defenders should continue to monitor the IP address 216.150.1.129 for any re‑activation, update intrusion detection signatures to include the observed certificate thumbprint and Vercel DNS patterns, and ensure that corporate web filtering solutions reference the current blocklist entry and Google Safe Browsing status.