webpage-coinbase-pro[.]created[.]app

The domain webpage-coinbase-pro.created.app was registered on July 12 2023 through Tucows Domains Inc. and resolves to the IPv4 address 216.150.16.193, which is owned by Amazon.com, Inc. (AS16509) and geolocated in the United States. The site serves a page whose title reads “Coinbase Pro Login – Advanced Trading Platform | Secure Access”, indicating an attempt to impersonate Coinbase’s professional trading portal. The TLS certificate is issued by Let’s Encrypt (R13), and the hosting stack reports Vercel with HTTP Strict Transport Security enabled, consistent with the nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. Public reputation services have flagged the domain.

Google Safe Browsing classifies it as a social‑engineering threat, and VirusTotal records 13 of 95 security vendors as detecting malicious activity. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. An HTTP request returns a 404 status code, and the current operational status is listed as offline, suggesting the site has been taken down or is no longer serving content. The available evidence points to a crypto‑scam campaign that leverages the Coinbase brand to lure victims into entering credentials or transferring funds.

However, no additional artifacts such as phishing mail samples, credential‑stealing scripts, or post‑exploitation infrastructure have been observed, leaving the full scope of the campaign uncertain. Defenders should add the domain and its associated IP address to firewall and DNS filtering rules, monitor for any resurgence of the same host or similar Vercel‑based deployments, and correlate logs for attempts to contact the domain or resolve its nameservers. Continuous threat‑intel feeds should be consulted for new indicators, and any observed traffic to the domain should be treated as malicious given the confirmed brand impersonation and multi‑vendor detection.