coinb-extension[.]created[.]app

Analysis of coinb-extension.created.app indicates a targeted brand‑impersonation effort aimed at Coinbase users. The domain, registered through Tucows Domains Inc. on July 12, 2023, resolves to the Amazon Web Services address 216.150.1.129, an IP owned by AS16509 Amazon.com, Inc. and located in the United States. DNS resolution is handled by ns1.vercel-dns.com and ns2.vercel-dns.com, reflecting the use of Vercel’s hosting platform; the site also presents an HSTS header and a valid Let’s Encrypt R13 certificate, both typical of legitimate services but also commonly abused by malicious actors. The only publicly observed page title is “Coinbase Extension | @Getting Started with Extension,” which directly references Coinbase and suggests an attempt to lure users into a crypto‑related extension workflow.

Google Safe Browsing flags the domain for social engineering, and nine of ninety‑five VirusTotal scanners have raised alerts, indicating a moderate consensus among security vendors that the site is malicious. PhishDestroy has added the domain to its blocklist, and it appears on a single additional security blocklist, reinforcing the perception of abuse. HTTP requests currently return a 404 status, and the domain has been taken offline, limiting immediate exposure but not eliminating the risk of re‑appearance.

Defenders should continue to block the domain at network perimeter controls, monitor DNS queries for the associated Vercel nameservers, and treat any inbound communications referencing a “Coinbase Extension” from this host as fraudulent. Incident response teams should also advise users to verify the authenticity of any Coinbase‑related extensions through official channels and to avoid providing credentials or wallet information to unsolicited sites. The combination of brand impersonation, crypto‑scam labeling, and detection by multiple security sources warrants elevated vigilance despite the domain’s current offline state.