coinbase-prologin-auth[.]created[.]app

coinbase-prologin-auth.created.app was registered through Tucows Domains Inc. on July 12, 2023 and is hosted on Amazon’s AS16509 infrastructure, resolving to IP 216.150.1.65 located in the United States. The domain uses Vercel DNS (ns1.vercel-dns.com, ns2.vercel-dns.com) and the web server reports Vercel as the underlying technology, with HTTP Strict Transport Security enabled. TLS is provided by a Let’s Encrypt R13 certificate, which is currently valid for the domain. An HTTP request to the root URL returns a 404 status, indicating that the page is not serving content at the time of analysis.

The page title observed in earlier crawls, “Coinbase Pro Login - Access Your Professional Trading Account | Official Guide,” explicitly references Coinbase’s professional trading service, confirming the intent to impersonate the Coinbase brand. VirusTotal has recorded 11 detections out of 95 scanned vendors, and Google Safe Browsing flags the domain for social engineering. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. No additional intelligence such as OTX references or malware kit attribution is available.

The combination of a brand‑specific page title, a recent registration date, and the use of a legitimate cloud provider to host the domain suggests a targeted credential‑harvesting campaign aimed at Coinbase users. Defenders should add the domain and its associated IP address to inbound and outbound filtering rules, monitor DNS queries for the domain and its Vercel name servers, and consider outreach to the registrar to request suspension. Because the site currently returns 404, any future re‑activation could present a functional login clone; continuous observation of the domain’s HTTP responses and SSL certificate renewal status is recommended.