pro-coinbase-public-en[.]created[.]app

The domain pro-coinbase-public-en.created.app was registered on July 12 2023 through Tucows Domains Inc. and resolves to the Amazon‑owned IP address 216.150.16.65 (AS16509, United States). The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating that the site is hosted on the Vercel platform. HTTPS is served by a valid Let’s Encrypt certificate (R13) and the server enforces HTTP Strict Transport Security. An HTTP request to the root URL returns a 404 status code, and the page title returned by the server is “Coinbase Pro Login – Secure Professional Trading Platform,” which directly references the Coinbase brand and suggests a credential‑harvesting intent. VirusTotal scans have recorded 15 detections out of 95 security vendors, and the domain appears on at least one public blocklist, currently listed by PhishDestroy.

The threat classification in the intelligence feed identifies the site as a crypto‑related brand‑impersonation campaign targeting Coinbase users. Analysis of the available artifacts confirms that the infrastructure aligns with typical phishing deployments: a cloud‑based hosting provider, a free TLS certificate, and a domain name that mimics a legitimate service (“pro‑coinbase‑public‑en”). The presence of a brand‑specific page title and the designation “Crypto Scam” in the intelligence further substantiate the impersonation claim. No additional content or page screenshots have been collected, so the exact login flow and any payload delivery mechanisms remain unverified.

Defenders should block the resolved IP address 216.150.16.65 and add the full domain to URL filtering and email security policies. Monitoring for newly created subdomains under the same registrar (Tucows) and for future DNS records pointing to the same Vercel nameservers is advised.