portel-cdn-coinbase[.]created[.]app

The domain portel-cdn-coinbase.created.app was registered on July 12, 2023 through Tucows Domains Inc. and is currently listed as offline, having been taken down after detection. Infrastructure analysis shows the domain resolves to the IP address 216.150.16.65, which belongs to Amazon.com, Inc. (AS16509) and is hosted in the United States. DNS resolution is handled by ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the use of Vercel’s hosting platform. The site presents an SSL certificate issued by Let’s Encrypt R13, and HTTPS responses include HTTP Strict Transport Security (HSTS), confirming that TLS is enforced.

When accessed via HTTP, the server returns a 404 status code, meaning no content is served at the time of testing. VirusTotal scans have flagged the domain in 11 of 95 security vendor engines, suggesting a consensus among multiple vendors that the domain is malicious. The domain appears on one external security blocklist and has been explicitly blocked by PhishDestroy. The page title retrieved from the site reads "Coinbase Pro Login - Step-by-Step Instructions," and the domain is classified as a crypto scam that impersonates the Coinbase brand.

While the site is currently offline, the presence of Vercel infrastructure, Amazon‑owned IP space, and a valid TLS certificate demonstrates a typical abuse pattern where legitimate services are leveraged to increase perceived trust. Defenders should add the domain and its associated IP address to outbound filtering rules, monitor for any resurgence of the domain or related subdomains, and consider extending blocklist ingestion to include the observed nameservers. Continuous observation of the IP range within AS16509 for new suspicious activities is advised, as threat actors may reuse the same hosting environment for future campaigns targeting cryptocurrency users.