coinbase-wellat[.]created[.]app

The domain coinbase-wellat.created.app was registered on July 12, 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.1.129, which is hosted in the United States under ASN 16509 (Amazon.com, Inc.). DNS resolution is delegated to ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the site was built on the Vercel platform. The site presented a TLS certificate issued by Let’s Encrypt (R13) and advertised HTTP Strict Transport Security (HSTS), but the HTTP response code returned was 404, suggesting the page content is missing or intentionally removed. The page title retrieved from the server was “Coinbase Extension – Your Gateway to Web3 & DeFi,” and the site was classified as a crypto‑related scam targeting the Coinbase brand.

Google Safe Browsing flagged the domain for social engineering, and ten of ninety‑five security vendors on VirusTotal marked it as malicious. The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy mitigation service. Current status is offline, and no further content is observable. Analysis indicates that the infrastructure—Vercel hosting, Amazon‑owned IP range, and a legitimate‑looking SSL certificate—was deliberately chosen to lend credibility to a phishing or credential‑harvesting campaign masquerading as a Coinbase extension.

The presence of a brand name in the page title and the classification as a “Crypto Scam” align with typical tactics used to lure cryptocurrency users. Uncertainty remains regarding the exact payload or credential‑capture mechanisms, as the site returns a 404 and no page content has been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host or similar subdomains, and add the IP address 216.150.1.129 to threat‑intel feeds. Further investigation of any associated traffic logs may reveal additional malicious components or command‑and‑control endpoints.