coinbes-logi-enn[.]created[.]app

coinbes-logi-enn.created.app is a newly identified malicious domain that was created on July 12 2023 through Tucows Domains Inc. The domain resolves to IP address 216.150.16.129, which belongs to Amazon.com, Inc. (AS16509) in the United States. DNS resolution is provided by Vercel’s authoritative name servers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the site advertised HTTPS with a Let’s Encrypt R13 certificate and HTTP Strict Transport Security (HSTS) enabled. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal records show that 13 of 95 scanning engines flagged the domain as malicious. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy remediation service.

An HTTP request to the host returns a 404 status code, indicating that the expected content is not currently served. The page title returned from the server is “Coinbase Login,” and the intelligence labels the activity as a crypto‑scam impersonating the Coinbase brand. No additional page content has been observed, and the exact phishing kit or payload has not been publicly disclosed. Analysis of the infrastructure suggests a low‑cost hosting approach, leveraging Vercel’s DNS and Amazon’s cloud platform, which is a common pattern for fast‑flux or short‑lived phishing campaigns.

The presence of HSTS and a valid TLS certificate can increase user trust, while the generic “Coinbase Login” title is intended to lure victims seeking cryptocurrency services. Defenders should immediately add the domain and its resolving IP address to network blocklists, monitor DNS queries for similar Vercel‑hosted subdomains, and enforce email or web gateway policies that warn users about unsolicited requests referencing Coinbase credentials. Continuous re‑scanning of the domain and its IP on VirusTotal and other sandbox services is advised in case the hosting configuration changes.