extension-base-io[.]created[.]app

This domain, extension-base-io.created.app, poses a significant threat by impersonating Coinbase, a well-known cryptocurrency exchange platform. The site was designed to deceive users into believing they were interacting with a legitimate Coinbase browser extension, titled 'Coinbase Extension: Your Secure Gateway to Crypto.' Such impersonation typically aims to harvest sensitive credentials, including login details, two-factor authentication codes, or cryptocurrency wallet information, which can lead to unauthorized access and financial loss for victims. Analysis indicates this domain was created on July 12, 2023, and registered through Tucows Domains Inc. It resolved to the IP address 216.150.16.1, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The domain was flagged by Google Safe Browsing as phishing and appeared on at least one security blocklist. Notably, VirusTotal reported that 10 out of 95 security vendors detected this domain as malicious, providing concrete evidence of its fraudulent nature. The SSL certificate was issued by Let's Encrypt, a common tactic used by threat actors to lend a false sense of legitimacy to their sites. Users who visited extension-base-io.created.app should take immediate action to mitigate potential risks. First, disconnect any devices used to access the site from the internet and run a full antivirus scan to detect any malware or unauthorized access. Change passwords for Coinbase and any other accounts where the same credentials may have been reused, prioritizing accounts linked to financial or cryptocurrency services. Enable multi-factor authentication where available, using an authenticator app rather than SMS-based methods. Monitor bank and cryptocurrency accounts for unauthorized transactions and report any suspicious activity to the relevant financial institutions. If personal or financial information was entered on the site, consider placing a fraud alert on credit reports to prevent identity theft.