coiinbsse-en-hellp[.]created[.]app

Analysis of coiinbsse-en-hellp.created.app shows a high‑risk brand‑impersonation operation targeting Coinbase users. The domain was registered through Tucows Domains Inc. on July 12, 2023 and is hosted on Vercel infrastructure, as indicated by the presence of Vercel DNS nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the use of HSTS. The site resolves to the IP address 216.150.16.193, which belongs to Amazon.com, Inc. (AS16509) in the United States. TLS is provided by a Let’s Encrypt certificate (R13), confirming that HTTPS is active, but the HTTP response returns a 404 status, suggesting the content may be dynamically generated or removed.

The page title captured from the site reads "Coinbase Pro® Sign In | Official Login™ Portal," directly referencing the Coinbase brand and confirming the intent to deceive. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 12 of 95 security vendors have flagged the domain as malicious. It appears on one external security blocklist and has been taken down by the PhishDestroy takedown service. The combination of brand impersonation, the crypto‑scam classification, and the technical footprint indicates a coordinated effort to harvest Coinbase credentials or lure victims into fraudulent cryptocurrency transactions.

Defenders should block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists to include the domain and its associated IP, and monitor for any outbound traffic to the IP range owned by AS16509. Incident response teams should also inspect logs for attempts to access the domain or resolve its IP, and consider outreach to the registrar and hosting provider to enforce takedown or remediation. Continuous monitoring of related Vercel‑hosted subdomains is advised, as threat actors often reuse infrastructure for subsequent campaigns.