coinbase-secure[.]created[.]app

On 24 July 2026 analysis was performed on the domain coinbase-secure.created.app, which is currently offline. The site was registered through Tucows Domains Inc. on 12 July 2023 and uses Vercel‑provided nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com). DNS resolution points to IP address 216.150.1.1, an Amazon.com, Inc. host in the United States (AS16509). The TLS certificate is issued by Let’s Encrypt (R13) and the site advertised HTTP Strict Transport Security.

An HTTP request returned a 404 status code, and the page title presented to browsers was “Login to Coinbase Pro – Securely Manage Your Trades”, explicitly targeting the Coinbase brand. Google Safe Browsing classified the URL as a social‑engineering threat, and PhishDestroy listed it on its blocklist, resulting in a single security blocklist entry. VirusTotal scans reported nine detections out of ninety‑five scanners. The observed technology stack consists of Vercel hosting and HSTS enforcement, consistent with many short‑lived impersonation campaigns.

The evidence indicates a crypto‑related scam aimed at harvesting Coinbase credentials, though the exact content of the landing page beyond the title has not been captured. Defensive recommendations include adding the domain and its resolving IP to firewall deny lists, updating intrusion‑detection signatures with the observed indicators, and monitoring for any re‑registration of the sub‑domain or similar Vercel‑based infrastructure. Continuous verification of Google Safe Browsing and PhishDestroy feeds is advised to capture any future activity.