coinbase-pro-learn[.]created[.]app

This domain is classified as a high-risk brand impersonation phishing site designed to deceive users into disclosing credentials for Coinbase, a cryptocurrency exchange platform. The site mimics legitimate Coinbase login pages, increasing the likelihood of successful credential theft or financial fraud through social engineering tactics. Analysis indicates a targeted effort to exploit trust in the Coinbase brand, with potential secondary payloads such as crypto drainers or malware distribution upon successful compromise. Infrastructure analysis reveals the domain coinbase-pro-learn.created.app was registered on July 12, 2023, through Tucows Domains Inc. and resolves to IP address 216.150.1.65, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain is flagged by Google Safe Browsing as phishing and appears on 2 security blocklists, including PhishDestroy and PhishingDB. VirusTotal detection rates show 18 out of 95 security vendors marking the domain as malicious. The SSL certificate is issued by Let's Encrypt (R13), a common certificate authority exploited by threat actors to lend false legitimacy to phishing sites. The page title, 'Coinbase - Sign In,' further confirms the intent to impersonate the legitimate Coinbase login portal. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (216.150.1.65) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) systems, web proxies, and email gateways to prevent access or redirection. User awareness training should emphasize the risks of brand impersonation, particularly for cryptocurrency platforms, and encourage verification of domain authenticity before entering credentials. Organizations should monitor for unauthorized access attempts or anomalous login activity originating from internal networks, as compromised credentials may be leveraged for further attacks. Given the domain's current offline status, continuous monitoring for reactivation or re-registration under similar naming conventions is recommended.