sso-conbase-en[.]created[.]app

This domain, sso-conbase-en.created.app, poses a threat through brand impersonation, specifically targeting Coinbase. If accessed, it could lead to the theft of user credentials or financial information, putting visitors at significant risk.

Analysis indicates that the domain was created on July 12, 2023, and is registered through Tucows Domains Inc. The site's SSL certificate is issued by Let's Encrypt / R13, which can lend a false sense of security. VirusTotal reports that 14 out of 95 security vendors flag this domain as malicious, and it has been taken offline and blocked by PhishDestroy. The domain resolves to the IP address 216.150.1.65, which is located in the United States and is associated with AS16509 Amazon.com, Inc. This combination of factors suggests a well-coordinated attempt to deceive users into believing they are interacting with a legitimate Coinbase service.

If a user has visited this domain, they should immediately change their Coinbase account passwords and enable two-factor authentication (2FA). It is also recommended to monitor account activity for any unauthorized transactions and to report any suspicious activity to Coinbase support. Additionally, users should run a full system scan using reputable antivirus software to ensure no malware was installed during the visit.