conbse-pro-logn[.]created[.]app

Analysis of conbse-pro-logn.created.app indicates that the domain is currently offline but retains artifacts typical of a brand‑impersonation campaign targeting Coinbase users. The domain was registered on July 12, 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.1.65, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Hosting infrastructure shows the presence of Vercel services and the domain enforces HSTS, while the TLS certificate is issued by Let’s Encrypt under the R13 profile, confirming the use of a publicly trusted certificate. The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, consistent with the Vercel deployment.

The HTTP response for the host is a 404 status code, suggesting that the malicious landing page has been removed or the site is no longer serving content. Despite the offline status, the domain appears on one security blocklist, PhishDestroy, and has been flagged by seven out of ninety‑five VirusTotal scanners, reinforcing the suspicion of malicious intent. The page title retrieved from the domain, "Coinbase Pro Login - Professional Crypto Trading Platform Access | Secure Sign In," explicitly references Coinbase and aligns with the recorded scam type of a crypto‑related impersonation. This title, together with the brand target label, demonstrates a clear attempt to lure victims into credential harvesting or other cryptocurrency‑focused fraud.

At this stage, the exact content of the former landing page cannot be verified, and the current threat surface is limited to the domain’s infrastructure and historical indicators. defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP address and nameservers, and update endpoint and email filtering rules to catch any residual communications that reference the domain or its known page title.