sso-coinbase-ext[.]created[.]app

The domain sso-coinbase-ext.created.app was registered on 12 July 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.1.65, which is owned by Amazon.com, Inc. (AS16509) and geolocated in the United States. The site presents a page title of "coinbase wallet extension©: | secure your crypto wallet," directly referencing Coinbase and indicating a crypto‑related impersonation campaign. A Let's Encrypt R13 certificate secures the HTTPS service, while the hosting stack is identified as Vercel with HTTP Strict Transport Security (HSTS) enabled. DNS is delegated to ns1.vercel-dns.com and ns2.vercel-dns.com.

HTTP requests to the host return a 404 status, and the domain is currently taken offline. VirusTotal analysis shows that ten of ninety‑five scanning engines flag the domain as malicious, and the domain appears on at least one external blocklist and is blocked by PhishDestroy. The combination of a Coinbase‑specific page title, crypto‑scam classification, and the observed malicious detections suggests the domain was used to lure victims into a credential‑stealing or wallet‑drain operation.

No additional content has been captured, and the exact payload or phishing page layout remains unknown. Defenders should consider adding the domain and its associated IP address to network‑level blocklists, monitor for further Vercel‑hosted domains with similar naming patterns, and enforce strict outbound filtering for cryptocurrency‑related URLs. Continuous observation of the registrar, DNS changes, and any resurgence of the domain in threat feeds is recommended to mitigate potential re‑use.