coinbaseprolog[.]created[.]app

The domain coinbaseprolog.created.app was registered through Tucows Domains Inc. on July 12, 2023 and is presently taken offline. Infrastructure analysis shows the domain resolves to IP address 216.150.1.129, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States. The site served a TLS certificate issued by Let\'s Encrypt (R13) and advertised HSTS, indicating an attempt to present a secured appearance. DNS resolution is handled by Vercel name servers ns1.vercel-dns.com and ns2.vercel-dns.com, and technology profiling detected the Vercel hosting platform.

The HTTP response returned a 404 status code, consistent with the reported offline state. Content analysis reveals the page title "Coinbase Pro Login – Access Your Crypto Trading Dashboard," confirming a direct impersonation of Coinbase and aligning with the classified crypto scam type. Google Safe Browsing flagged the domain for social engineering, and VirusTotal recorded nine detections out of ninety‑five scanners, reinforcing the malicious assessment.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Defenders should add the domain and its resolving IP to outbound and inbound deny lists, monitor DNS queries for any re‑registration or activation, and ensure that any corporate authentication portals enforce multi‑factor authentication and brand‑validated URLs. Continuous threat‑intel feeds should be consulted for potential re‑use of the Vercel infrastructure or the Amazon‑hosted IP range in future impersonation campaigns targeting Coinbase users.