conbase-login-io[.]created[.]app

Analysis of the domain conbase-login-io.created.app confirms it as a high-risk phishing site targeting Coinbase users, operational between its registration on July 12, 2023, and its takedown prior to July 23, 2026. The domain impersonates Coinbase, as evidenced by the page title 'Login to Coinbase Pro | Trusted Crypto Exchange Platform' and its explicit classification as a crypto scam in available threat intelligence. Infrastructure analysis reveals the domain was hosted on IP 216.150.16.129, geolocated in the US under Amazon.com, Inc. (AS16509), and utilized nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, indicating Vercel-based hosting. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites.

Detection data shows the domain was blocked by PhishDestroy and flagged by Google Safe Browsing for social engineering. VirusTotal reports 15 of 95 security vendors marked the domain as malicious, though the absence of additional context limits further interpretation of these detections. The domain appeared on one security blocklist, and its HTTP status at the time of reporting was 404, consistent with a takedown or voluntary removal.

Registrar details confirm registration through Tucows Domains Inc. Defenders should treat this domain as confirmed malicious, prioritize blocking it at DNS and proxy levels, and review logs for connections from internal networks. The use of HSTS and Vercel technologies suggests an attempt to appear legitimate, reinforcing the need for heightened scrutiny of similar infrastructure. No evidence of a specific phishing kit or additional payload delivery was present in the available data.