logi-coinbasepro[.]created[.]app

This domain, logi-coinbasepro.created.app, was observed delivering a credential‑harvesting page that pretended to offer a Coinbase Pro login guide. The page title returned by the server is "Coinbase Pro Login Guide: Step‑by‑Step Instructions for Beginners," directly referencing the targeted brand. VirusTotal records show that 13 of 95 scanned security vendors flagged the domain as malicious, indicating a moderate consensus of compromise. Google Safe Browsing classifies the site as social‑engineering, and the domain appears on one external blocklist, which is currently enforced by PhishDestroy. An HTTP request to the host returns a 404 status, suggesting the malicious content has been removed or the site is no longer serving the original page.

Infrastructure analysis reveals the domain resolves to IP 216.150.1.65, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The hosting environment uses Vercel services, as indicated by the presence of ns1.vercel-dns.com and ns2.vercel-dns.com as authoritative name servers, and the site advertised HTTP Strict Transport Security (HSTS). The TLS certificate is issued by Let’s Encrypt (R13), which is typical for short‑lived certificates but does not mitigate the underlying threat. Registration data shows the domain was created on 12 July 2023 through Tucows Domains Inc., a common registrar for disposable or malicious domains.

The listed scam type is "Crypto Scam," aligning with the impersonation of Coinbase, a cryptocurrency exchange. Because the site is currently offline, direct content analysis is not possible; however, the combination of brand‑specific page title, vendor detections, Safe Browsing flag, and blocklist inclusion provides sufficient evidence to classify the domain as a high‑risk brand‑impersonation artifact. Defenders should ensure the domain is added to network and endpoint blocklists, monitor for similarly structured subdomains under the *.created.