coinbase-cloud-auth[.]created[.]app

The domain coinbase-cloud-auth.created.app was registered through Tucows Domains Inc. on July 12, 2023. It resolves to the IPv4 address 216.150.1.1, which is assigned to Amazon.com, Inc. (AS16509) and geolocated to the United States. DNS resolution is handled by Vercel’s authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, indicating that the site was hosted on Vercel’s platform. The HTTPS service uses a Let’s Encrypt R13 certificate, and the site advertises HTTP Strict Transport Security (HSTS).

An HTTP request returns a 404 status, and the page title observed is “How to Use Coinbase Extension – Complete Beginner’s Guide,” suggesting a content focus on a Coinbase browser extension. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has actively blocked it. The domain appears on a single security blocklist, and VirusTotal reports ten detections out of ninety‑five scanners, reflecting a moderate consensus among automated analysis tools that the site is malicious. The threat is classified as a brand impersonation targeting Coinbase and is described as a crypto‑related scam.

As of the report date, July 24, 2026, the site is offline. Defenders should continue to block the IP address 216.150.1.1 and the associated ASN, enforce outbound DNS filtering for the domain, and incorporate the domain’s hash and URL pattern into intrusion detection signatures. Monitoring for re‑registration or similar sub‑domains using the same Vercel infrastructure is advisable, as adversaries may attempt to revive the campaign under a new name.