help-pro-coinbase[.]created[.]app

The domain help-pro-coinbase.created.app was created on July 12, 2023 and is registered through Tucows Domains Inc. It resolves to IP address 216.150.16.65, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site is hosted on Vercel, as indicated by the nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, and the technology stack includes Vercel services and HTTP Strict Transport Security (HSTS). The TLS certificate is issued by Let’s Encrypt (R13), providing valid encryption but offering no assurance of legitimacy. HTTP probing returns a 404 status, and the domain is currently taken offline.

Reputation services show a mixed risk profile: Google Safe Browsing flags the domain for social engineering, PhishDestroy has blocked it, and it appears on one external security blocklist. VirusTotal analysis recorded 12 detections out of 95 scanning engines, reinforcing the malicious assessment. The page title "Coinbase Pro Login - Advanced Crypto Trading Platform 🚀" explicitly references the Coinbase brand, confirming a brand‑impersonation intent aimed at cryptocurrency users.

While the visual content of the landing page has not been captured, the combination of brand‑targeted title, cryptic crypto‑scam categorisation, and multiple independent detections provides strong evidence of a credential‑harvesting campaign. Defenders should proactively block the domain at DNS resolvers and web filters, monitor the associated IP range for related activity, and consider adding the IP to threat‑intelligence feeds. Continuous re‑evaluation is advised in case the site becomes active again or new indicators emerge.