coinbase-pro-help[.]created[.]app

Analysis of coinbase-pro-help.created.app, observed on July 24, 2026, identifies the domain as a high‑risk, brand‑impersonation infrastructure targeting Coinbase users. The site was registered through Tucows Domains Inc. on July 12, 2023 and resolves to IP address 216.150.1.129, an Amazon.com, Inc. host within ASN 16509 located in the United States. DNS resolution uses Vercel name servers (ns1.vercel-dns.com, ns2.vercel-dns.com), and the underlying web stack reports Vercel technology with HTTP Strict Transport Security enabled. The domain presents a TLS certificate issued by Let’s Encrypt (R13), confirming the use of a valid, publicly trusted certificate.

An HTTP request returns a 404 status, indicating that the expected content is no longer accessible, and the domain’s current operational state is recorded as offline. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single security blocklist. Independent security services have flagged the domain, with 11 of 95 VirusTotal scanners marking it as malicious. PhishDestroy has also blocked the domain.

The page title retrieved from the site, "Coinbase Pro Sign‑In Guide: Fast & Secure Trading Access," directly references the Coinbase brand, confirming intentional impersonation. The threat is cataloged as a crypto‑scam, aligning with the brand‑targeted approach. Defenders should continue to block the domain at network perimeters, update URL filtering and threat‑intel feeds with the observed indicators, and monitor for any re‑registration attempts that reuse the same naming pattern or hosting configuration. Evidence from the registrar, hosting ASN, TLS certificate, detection counts, and Safe Browsing classification collectively substantiate the domain’s malicious intent and justify its high‑risk designation.