chrome-ext-coin[.]created[.]app

Analysis of chrome-ext-coin.created.app, observed on July 23, 2026, indicates a high‑risk brand‑impersonation infrastructure targeting Coinbase users. The domain was registered on July 12, 2023 through Tucows Domains Inc. and resolves to IP address 216.150.16.65, an Amazon.com, Inc. (AS16509) host located in the United States. DNS resolution is provided by ns1.vercel-dns.com and ns2.vercel-dns.com, confirming deployment on the Vercel platform. The site presents a TLS certificate issued by Let’s Encrypt (R13) and enforces HTTP Strict Transport Security, suggesting an attempt to appear legitimate.

The HTTP response returned a 404 status, and the page title retrieved was "Homepage | Coinbase Wallet extension - Chrome Web," directly referencing the Coinbase Wallet Chrome extension and reinforcing the impersonation claim. Google Safe Browsing has flagged the domain for social engineering, and 14 of 95 security vendors on VirusTotal have marked the host as malicious, indicating consensus among detection engines. The domain appears on a single security blocklist, PhishDestroy, and has been taken offline at the time of analysis.

While the exact payload or credential‑harvesting mechanisms are not observable due to the offline status, the combination of brand‑specific page title, crypto‑scam classification, and multiple vendor detections provides strong evidence of a fraudulent operation. Defenders should immediately block the domain and its associated IP, update intrusion‑detection signatures to include the observed TLS fingerprint and DNS records, and monitor for any resurgence of the infrastructure on adjacent Vercel or AWS resources. Continuous observation of the registrar and DNS changes is advised, as threat actors may re‑register similar domains to resume the campaign.