coinbase-en[.]created[.]app

This domain, coinbase-en.created.app, was registered through Tucows Domains Inc. on July 12, 2023 and subsequently resolved to the IP address 216.150.1.193, which belongs to Amazon.com, Inc. (AS16509) in the United States. The site presented the page title “Coinbase Pro Login | Access Your Advanced Crypto Trading Dashboard,” indicating an attempt to impersonate Coinbase’s professional trading portal. The SSL certificate was issued by Let’s Encrypt under the R13 identifier, and the HTTP response returned a 404 status, suggesting the landing page is no longer reachable. Vercel infrastructure is evident from the detected technologies, including Vercel hosting and HTTP Strict Transport Security, and the domain's authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com.

Google Safe Browsing flagged the domain for social engineering, and VirusTotal recorded 13 detections out of 95 scanned security vendors, reinforcing the malicious assessment. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed. The overall risk rating is high, and the threat type is identified as brand impersonation targeting Coinbase users in a crypto‑scam context.

While the site is currently offline, defenders should continue to monitor DNS resolutions to the associated IP, enforce blocklist updates, and ensure that any inbound traffic to the Vercel nameservers referencing this domain is denied. Correlation with other Coinbase‑related phishing indicators is recommended to uncover potential campaign links. The evidence presented confirms the domain’s role in a targeted brand‑impersonation operation.