coinbasepro-eng[.]created[.]app

This domain, coinbasepro-eng.created.app, was identified as a high-risk phishing site targeting Coinbase users, specifically impersonating the Coinbase Pro platform. Registered through Tucows Domains Inc. on July 12, 2023, the domain resolved to the IP address 216.150.1.65, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The site employed Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and utilized a Let's Encrypt SSL certificate (R13), indicating an attempt to appear legitimate through HTTPS enforcement. The page title, 'Coinbase Pro Login – Sign In to Trade Crypto with Pro Tools,' directly aligns with the targeted brand, confirming its intent to deceive users into submitting credentials. Analysis reveals the domain was flagged by 11 of 95 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in available intelligence.

Google Safe Browsing classified the site as engaging in social engineering, a designation consistent with credential harvesting or crypto scam activity. The domain appeared on at least one security blocklist, and as of July 24, 2026, it returned an HTTP 404 status, suggesting it has been taken offline or abandoned. The registrar, Tucows, and hosting provider, Vercel, may have played roles in its eventual disruption, though no public takedown notices or legal actions are confirmed. Defenders should note the domain's infrastructure patterns, including its use of Vercel hosting and Amazon IP space, which may recur in future campaigns. The SSL certificate issuer (Let's Encrypt) and HSTS implementation are common in both legitimate and malicious sites, so these attributes alone are not indicative of compromise.

The page title and brand impersonation are the strongest indicators of malicious intent. Organizations are advised to block the domain, IP, and associated nameservers at the perimeter. Security teams should review logs for connections to 216.150.1.