coinbasepro-login-sso[.]created[.]app

This domain, coinbasepro-login-sso.created.app, was taken offline as of the reporting date of July 23 2026. Infrastructure analysis shows the site was hosted on Vercel’s edge network, indicated by the presence of Vercel DNS nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the use of HTTPS with a Let’s Encrypt R13 certificate. The domain resolves to IP address 216.150.16.1, which belongs to Amazon.com, Inc. (AS16509) and is geolocated to the United States. HTTP requests return a 404 status, suggesting the content has been removed or the site is no longer serving pages.

The page title that was observed prior to takedown reads “Coinbase Pro Login Guide – Access Your Advanced Trading Platform,” directly referencing Coinbase’s brand. Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has listed the domain on its blocklist. The registrar is Tucows Domains Inc., and the domain was created on July 12 2023. VirusTotal analysis shows that twelve of ninety‑five scanning engines flagged the domain, reinforcing the presence of malicious activity.

The threat is identified as a crypto‑scam that impersonates Coinbase, aiming to lure users into credential harvesting or financial loss. While the exact payload or credential‑capture mechanism has not been captured, the combination of brand impersonation, cryptographic terminology in the title, and the observed blocklist entries strongly indicates a targeted fraud campaign. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual traffic to the resolved IP, and advise users that any login page hosted at this address is illegitimate. Ongoing threat‑intel feeds should be consulted for possible reuse of the hosting infrastructure or related domains.