ecoinbase-signin-page[.]created[.]app

Analysis indicates that the domain ecoinbase-signin-page.created.app was registered through Tucows Domains Inc. on 12 July 2023 and resolves to the Amazon Web Services address 216.150.16.1, ASN AS16509 located in the United States. The site was served using Vercel infrastructure, as reflected by the nameservers ns1.vercel-dns.com and ns2.vercel-dns.com and the presence of HSTS headers. An SSL certificate issued by Let’s Encrypt (R13) was active at the time of observation, providing transport-level encryption but offering no assurance of legitimacy. The page title returned by the HTTP endpoint reads “Log-In Coinbase – Buy and Sell Bitcoin, Ethereum”, directly referencing the Coinbase brand, confirming a brand-impersonation objective aimed at cryptocurrency users.

The HTTP response code was 404, indicating the page was not serving content when queried, and the domain is currently listed as offline. Reputation data show that the domain appears on a single security blocklist and was flagged by Google Safe Browsing for social engineering. VirusTotal recorded 12 detections out of 95 scanned antivirus and sandbox engines, and PhishDestroy has also blocked the domain. The combination of a brand-specific page title, use of a reputable CDN, and moderate detection counts suggest an opportunistic crypto-scam campaign that leveraged a trusted TLS certificate to increase perceived trustworthiness.

Uncertainty remains regarding the exact phishing kit or credential-capture mechanism, as no content was retrieved and no further forensic artifacts were disclosed. Defenders should continue to monitor DNS queries for the ecoinbase-signin-page.created.app hostname, enforce outbound filtering for connections to the associated IP address, and update web-gateway and email security policies to block URLs containing the domain or the “ecoinbase-signin-page” pattern.