eng-coinns-com-us[.]created[.]app

This domain is flagged as a high-risk brand impersonation threat designed to deceive users of the targeted cryptocurrency exchange. Analysis indicates the site mimics Coinbase’s authentication portal, presenting a login interface titled 'Coinbase - Sign in | Your Digital Asset Gateway' to harvest credentials or facilitate unauthorized transactions. The specific threat type—brand impersonation with potential credential theft or crypto drainer functionality—poses significant financial and data exposure risks to victims. Infrastructure analysis reveals multiple technical indicators supporting malicious classification. The domain, eng-coinns-com-us.created.app, was registered on February 25, 2026, through Tucows Domains Inc., and resolves to the IP address 216.150.16.65. It appears on three security blocklists and is flagged by 16 out of 95 security vendors on VirusTotal. The site employs a Let’s Encrypt SSL certificate and utilizes technologies including Node.js, React, Google Cloud, Vercel, Next.js, LaunchDarkly, HSTS, and Google Cloud CDN. Google Safe Browsing classifies the domain under 'SOCIAL_ENGINEERING,' and Gridinsoft assigns a trust score of 0/100. Additional detection by MetaMask, PhishDestroy, and SEAL further corroborates its malicious intent. Mitigation steps for this threat type include immediate reporting to the impersonated brand’s security team for takedown and domain suspension. Users who may have interacted with the site should revoke active sessions, reset credentials using multi-factor authentication, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP, while security teams should analyze network logs for connections to 216.150.16.65 or related infrastructure. Given the domain’s offline status, continuous monitoring for re-emergence or similar typosquatting variants is recommended to prevent recurrence.