coinbase-chrome[.]created[.]app

The domain coinbase-chrome.created.app was first observed on July 12, 2023 and is registered through Tucows Domains Inc. Its authoritative name servers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating that the site is hosted on Vercel infrastructure. The site presents a TLS certificate issued by Let’s Encrypt (R13) and enforces HSTS, which can give a false sense of legitimacy. The sole page title discovered reads "Coinbase Chrome Extension - Trade Crypto Instantly in Your Browser," directly referencing the Coinbase brand and suggesting a crypto‑related browser extension. An HTTP request to the domain returns a 404 status, and the domain has been taken offline as of the report date.

Network analysis shows the domain resolves to IP 216.150.16.193, located in the United States and owned by AS16509 Amazon.com, Inc., a common hosting provider for malicious actors. The domain is listed on one security blocklist and has been blocked by PhishDestroy. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports 11 of 95 scanning engines flagging the domain, reinforcing its malicious reputation. The overall risk rating is high and the scam type is identified as a crypto scam targeting users of Coinbase.

Defenders should immediately add coinbase-chrome.created.app to URL filtering and DNS block policies, monitor outbound connections to the associated Amazon IP range, and watch for newly created Vercel subdomains that mimic the Coinbase brand. Since the site currently returns a 404, any future activation may involve new malicious payloads; continuous threat‑intel feeds should be consulted for re‑appearance. Organizations should also educate users about unsolicited Chrome extension prompts and advise verification through official Coinbase channels before installing any extension.