coinbase-extension-cloud[.]created[.]app

Analysis of coinbase-extension-cloud.created.app shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered on 12 July 2023 through Tucows Domains Inc. and resolves to IP address 216.150.1.65, which belongs to Amazon.com, Inc. (AS16509) and is physically located in the United States. Infrastructure traces indicate the site is hosted on Google Cloud and served via Vercel, with ancillary services including LaunchDarkly for feature flagging, HTTP Strict Transport Security (HSTS), and Google Cloud CDN. The domain uses Let's Encrypt (R13) for TLS, presenting a valid certificate that may lend superficial credibility.

The page title returned by the server is "Coinbase Extension | Secure Browser Access to Your Crypto Tools," which directly references the Coinbase brand and aligns with the declared scam type of a crypto scam. HTTP response code is 404, suggesting the content is no longer reachable; the site is currently offline but was previously flagged by multiple defenses. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on at least one public blocklist, where it is listed by PhishDestroy. VirusTotal analysis recorded 15 detections out of 95 scanned security vendors, reinforcing the malicious classification.

Defenders should update URL filtering and DNS sinkhole rules to block both the exact FQDN and its authoritative name‑servers (ns1.vercel-dns.com, ns2.vercel-dns.com). Monitoring for newly provisioned subdomains under the same registrar (Tucows) and for traffic to the associated IP range (216.150.1.0/24) is recommended, as threat actors often reuse infrastructure. Because the site is presently offline, continuous re‑evaluation is required to capture any re‑activation or migration to alternative hosting. Organizations should educate users about unsolicited requests for Coinbase credentials and enforce multi‑factor authentication to mitigate credential‑theft risk.