web-coinbase-prologin[.]created[.]app

Analysis of web-coinbase-prologin.created.app, observed on July 24, 2026, indicates a credential‑harvesting site that impersonates Coinbase. The domain was registered through Tucows Domains Inc. on July 12, 2023 and resolves to the Amazon Web Services address 216.150.1.65, announced under ASN AS16509 (Amazon.com, Inc.) and located in the United States. The hosting provider is Vercel, as evidenced by the presence of Vercel DNS nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the detection of Vercel‑specific technologies and HSTS enforcement. An SSL certificate issued by Let’s Encrypt (R13) secures the site, a common tactic used to lend legitimacy to malicious pages.

The HTTP response returned a 404 status, suggesting the original landing page has been removed; the domain is currently taken offline, and the URL was blocked by PhishDestroy and listed on a single security blocklist. VirusTotal scans recorded seven detections out of ninety‑five scanners, reinforcing the malicious classification. The page title "Access Coinbase Pro – Login to Your Professional Trading Dashboard" directly references Coinbase Pro, confirming the brand impersonation claim. The scam type is identified as a crypto scam targeting users of Coinbase.

While the exact content of the page cannot be verified because the site is offline, the combination of brand‑specific page title, cryptic domain naming, and the observed infrastructure strongly suggests a phishing operation aimed at capturing Coinbase credentials. Defenders should continue to block the domain at perimeter filters, monitor for any re‑registration attempts, and add the associated IP address 216.150.1.65 to threat‑intel feeds. Organizations using Coinbase services should alert users to the impersonation attempt and advise verification of URLs before entering credentials. Ongoing surveillance of the registrar Tucows and the hosting provider Vercel is recommended to detect future campaigns that may reuse similar infrastructure.