coiinbasawallatextensonweb3[.]created[.]app

This domain, coiinbasawallatextensonweb3.created.app, poses a high-risk brand impersonation threat specifically targeting users of the Coinbase cryptocurrency platform. Analysis of the page content reveals a fraudulent Coinbase Wallet extension landing page, titled 'Coinbase Wallet Extension: Install, Connect & Start Using Web3 Tools,' designed to deceive visitors into downloading malicious software. The site mimics legitimate Coinbase branding, including logos, color schemes, and web3-related terminology, to trick users into believing they are accessing an official Coinbase product. Such impersonation tactics are commonly employed in cryptocurrency drainer schemes, where victims are lured into connecting their wallets to malicious smart contracts, resulting in unauthorized fund transfers. Technical indicators confirm the malicious nature of this domain. The domain was registered on July 12, 2023, through Tucows Domains Inc., a registrar frequently associated with phishing infrastructure. It resolves to the IP address 216.150.1.1, hosted on Amazon.com, Inc. (AS16509) in the United States. Detection metrics further substantiate the threat: VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while two independent security blocklists, including PhishDestroy and PhishingDB, have blacklisted it. The domain’s SSL certificate, issued by Let’s Encrypt (R13), does not mitigate its risk, as fraudulent sites commonly use valid certificates to appear legitimate. Additionally, Google Safe Browsing has explicitly classified this domain as phishing. Users who visited coiinbasawallatextensonweb3.created.app should take immediate remedial action to mitigate potential risks. If any software was downloaded or installed from the site, the affected device should be scanned using updated security tools to detect and remove malicious payloads. Cryptocurrency wallet holders who connected their wallets to the site must assume compromise and transfer assets to a new, secure wallet immediately. All credentials, including passwords and recovery phrases, should be rotated, and multi-factor authentication should be enabled on all critical accounts. Users are advised to monitor financial and cryptocurrency accounts for unauthorized transactions and report the incident to relevant fraud reporting platforms. Given the domain’s current offline status, further interaction is unlikely, but vigilance is recommended for similar impersonation attempts.