coiinbse-chroome-exte[.]created[.]app

Analysis of the domain coiinbse-chroome-exte.created.app indicates a high-risk brand impersonation campaign targeting Coinbase users. The domain was registered on July 12, 2023, through Tucows Domains Inc., and is hosted on infrastructure associated with AS16509 (Amazon.com, Inc.), resolving to the IP address 216.150.1.129 located in the United States. The domain's nameservers (ns1.vercel-dns.com and ns2.vercel-dns.com) and detected technologies (Vercel, HSTS) suggest the use of a platform commonly employed for rapid deployment of phishing pages. The page title, 'Coinbase Chrome Extension - Seamless Crypto Management in Your Browser,' explicitly impersonates Coinbase, a cryptocurrency exchange platform, aligning with the classified scam type of an investment scam.

Google Safe Browsing has flagged this domain for social engineering, a classification consistent with phishing activities designed to deceive users into divulging sensitive information or transferring assets. As of the latest assessment, the domain returns an HTTP 404 status, indicating it is currently offline. However, prior to its takedown, the domain was detected by 10 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. The SSL certificate is issued by Let's Encrypt (R13), a common certificate authority for both legitimate and malicious domains, providing no definitive indication of trustworthiness.

Defenders should treat this domain as part of a broader pattern of Coinbase impersonation campaigns, particularly those leveraging browser extension themes to exploit user trust. The use of Vercel-hosted infrastructure and a Let's Encrypt certificate is a recurring tactic in such scams, enabling rapid setup and takedown to evade detection. While the domain is currently offline, organizations are advised to block the domain and associated IP (216.150.1.