coinbaseex[.]created[.]app

The domain coinbaseex.created.app was registered through Tucows Domains Inc. on July 12, 2023 and is hosted on Amazon's AS16509 network, resolving to 216.150.16.1 in the United States. DNS resolution points to Vercel name servers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the site served a TLS certificate from Let’s Encrypt (R13) with HSTS enabled. An HTTP request returned a 404 status code, and the page title reported “Coinbase AddOn!”. Google Safe Browsing classifies the URL as social engineering, and PhishDestroy has listed it as blocked.

The domain appears on a single security blocklist and VirusTotal recorded eight detections out of ninety‑five scanners. The campaign is labeled a crypto scam and explicitly impersonates the Coinbase brand. No additional content analysis is available beyond the title; the actual payload, form fields, or credential‑capture mechanisms have not been observed.

The infrastructure indicates a rapid‑deployment model typical of Vercel‑based phishing kits, but the short lifespan—taken offline by the reporting date—limits further attribution. Defenders should continue to block the domain at DNS and proxy layers, monitor for similar sub‑domains under the created.app suffix, and consider adding the IP address to threat‑intel feeds. Ongoing observation of the registrar and hosting provider may reveal repeat abuse, and any future resurrection of the domain should be re‑evaluated against the existing detection markers.