coinbase-walet-extension[.]created[.]app

Analysis of coinbase-walet-extension.created.app shows a high‑risk brand‑impersonation operation targeting Coinbase users. The domain was registered on July 12, 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.16.129, which belongs to Amazon.com, Inc. (AS16509) in the United States. Infrastructure is hosted on Vercel, as indicated by the presence of Vercel DNS nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the detection of Vercel technology and HTTP Strict Transport Security (HSTS) on the site. The site served a 404 HTTP response and displayed the page title "Coinbase Wallet extension - Download Chrome Web Store," a clear attempt to mimic the legitimate Coinbase Wallet extension page.

An SSL certificate issued by Let’s Encrypt (R13) was present, providing a superficially trusted HTTPS connection. Google Safe Browsing flagged the URL for social engineering, and the domain appears on a single security blocklist. Independent analysis by VirusTotal recorded detections from ten of ninety‑five scanning engines, reinforcing the malicious classification. The site has been taken offline and is listed as blocked by PhishDestroy.

While the exact content of the landing page has not been captured, the combination of brand impersonation, the “Crypto Scam” label, and the technical indicators confirms a fraudulent operation designed to lure cryptocurrency users. Defenders should continue to block the domain at perimeter filters, monitor for any re‑hosting attempts, and advise users to verify the authenticity of Chrome Web Store extensions through official channels. Ongoing threat‑intel collection should watch for related domains that reuse the same registrar, hosting provider, or SSL certificate pattern, as adversaries often pivot to new URLs after takedown.