coinepro-sco[.]created[.]app

Analysis conducted on 23 July 2026 identifies the domain coinepro-sco.created.app as an offline infrastructure used to impersonate Coinbase. The domain was registered through Tucows Domains Inc. on 12 July 2023 and is hosted on Amazon's AS16509 network, resolving to IP 216.150.16.129 located in the United States. DNS resolution uses Vercel‑provided name servers (ns1.vercel-dns.com, ns2.vercel-dns.com), indicating the site was deployed on Vercel's platform, which also supplies the HSTS header observed during the brief availability window. The site presented a TLS certificate issued by Let’s Encrypt (R13), confirming encrypted HTTPS service before being taken offline. An HTTP request returned a 404 status code, suggesting the malicious landing page was removed or never served content at the time of testing.

The page title captured from the site—“Coinbase Pro Login – Trade Crypto with Pro Tools & Real‑Time Charts”—explicitly references Coinbase’s professional trading interface, confirming the brand impersonation claim. Google Safe Browsing classifies the domain as a social‑engineering threat, and VirusTotal records show that 12 of 95 scanning engines flagged the host, reinforcing the malicious intent. The domain appears on a single external blocklist and is currently listed as blocked by PhishDestroy, providing at least one operational mitigation. The overall risk assessment remains high because the infrastructure combines a reputable hosting provider, a valid TLS certificate, and a convincing brand‑specific title, all of which can increase user trust.

Uncertainties remain regarding the exact payload delivered to victims, as the HTTP 404 response prevents direct observation of any login form or credential‑harvesting script. No additional indicators such as malicious binaries, phishing email samples, or command‑and‑control endpoints have been disclosed.