help-coinbasepro-eng[.]created[.]app

The domain help-coinbasepro-eng.created.app was registered through Tucows Domains Inc. on July 12, 2023 and is currently listed as offline. DNS resolution points to the Amazon Web Services address 216.150.16.129, which belongs to AS16509 (Amazon.com, Inc.) and is located in the United States. The site presented a page title matching the legitimate Coinbase marketing copy – “Coinbase - Buy & Sell Bitcoin, Ethereum, and more …” – indicating a deliberate brand impersonation aimed at a crypto‑related scam. A Let's Encrypt R13 certificate was observed, and the hosting stack disclosed Vercel services with HTTP Strict Transport Security enabled, a typical configuration for short‑lived phishing pages.

VirusTotal recorded 13 detections out of 95 scanned security vendors, and the domain is flagged by Google Safe Browsing for social engineering. PhishDestroy has added the domain to its blocklist, and it appears on one additional security blocklist. The HTTP response returned a 404 status, which may indicate that the malicious page was removed before the current analysis. Nameservers ns1.vercel-dns.com and ns2.vercel-dns.com further confirm the Vercel hosting environment.

While the exact content of the page at the time of operation is not available, the combination of brand‑targeted page title, crypto‑scam classification, and the observed infrastructure strongly suggests a credential‑ harvesting or transaction‑draining campaign against Coinbase users. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same host or certificate fingerprint, and enforce multi‑factor authentication for Coinbase accounts. Threat intelligence feeds should be updated to include the domain, its IP address, and associated ASN to aid in rapid detection of future reuse.