coinbase-chrome-extensn[.]created[.]app

The domain coinbase-chrome-extensn.created.app was registered through Tucows Domains Inc. on July 12, 2023. It resolves to the IP address 216.150.1.129, which is hosted in the United States under ASN 16509 belonging to Amazon.com, Inc. The site presents the page title “Coinbase Chrome Extension – Secure Wallet Access in Your Browser,” explicitly referencing the Coinbase brand and indicating a crypto‑related scam. Analysis of the TLS certificate shows it is issued by Let’s Encrypt (R13) and the service is protected by HSTS, while the underlying infrastructure is identified as Vercel with authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. Google Safe Browsing flags the domain for social engineering, and it appears on a single security blocklist, currently blocked by PhishDestroy.

VirusTotal reports that 11 of 95 scanning engines have flagged the domain, reinforcing its malicious reputation. The HTTP response is a 404 status, and the domain has been taken offline as of the reporting date. The primary threat is brand impersonation of Coinbase, classified as a crypto scam, and the limited detection surface suggests the site was short‑lived but actively targeted cryptocurrency users. Uncertainty remains regarding any additional payloads, credential‑harvesting forms, or distribution of malware, as no page content has been captured.

Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the resolved IP and associated Vercel nameservers, and add the domain to internal threat intelligence feeds. Given the certificate and hosting details, any future attempts that reuse the same infrastructure are likely to follow a similar pattern, so alerts for new subdomains under created.app that reference Coinbase or crypto extensions should be prioritized. Ongoing vigilance is recommended, especially for users receiving unsolicited prompts to install Chrome extensions claiming to provide Coinbase wallet access.