welcome-coinpro-base[.]created[.]app

Analysis of welcome-coinpro-base.created.app shows that the domain was registered on July 12, 2023 through Tucows Domains Inc. and is currently hosted on Amazon's AS16509 network, resolving to 216.150.1.1. The authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating deployment on the Vercel platform. The site presented a TLS certificate issued by Let’s Encrypt (R13) and advertised HTTP Strict Transport Security (HSTS). An HTTP request returned a 404 status code, and the page title observed was “Official Site | Coinbase Pro | Secure Your Crypto,” directly referencing Coinbase and matching the declared brand target. The intelligence categorises the activity as a crypto‑related brand impersonation, with the scam type listed as “Crypto Scam.” VirusTotal scanned the domain and recorded detections by 7 of 95 security vendors, confirming malicious labeling by multiple engines.

PhishDestroy has already taken the domain offline, and it appears on one external blocklist. The domain is also flagged by the PhishDestroy blocklist and by at least one additional security blocklist. The observed indicators demonstrate a clear attempt to deceive users seeking Coinbase Pro services, leveraging a legitimate‑looking TLS certificate and the Vercel hosting environment to increase perceived trust. While the HTTP response is a 404, the presence of the targeted page title suggests that the content was previously served before takedown.

No additional payload, redirect chain, or credential‑harvesting page has been captured, leaving the exact user‑facing behavior uncertain. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address 216.150.1.1 for any future reuse, and update URL filtering rules to include the full domain name. Analysts should also flag any future registrations that reuse the same registrar, name‑server pair, or hosting provider in conjunction with Coinbase‑related keywords.