sso-coinnbse-extension[.]created[.]app

Analysis indicates that the domain sso-coinnbse-extension.created.app is currently offline, returning HTTP 404, but historical evidence shows it was used to impersonate Coinbase. The page title observed during prior scans read “Coinbase Wallet Extension – Secure Crypto Wallet for Your Browser,” matching the brand target Coinbase and the declared scam type of a crypto scam. The domain was registered on July 12, 2023 through Tucows Domains Inc. and uses Vercel‑provided nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com). Hosting resides on IP 216.150.16.1, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States.

TLS is supplied by Let’s Encrypt (R13) and the site enforced HSTS, indicating an attempt to appear legitimate. VirusTotal scans have flagged the domain in 11 of 95 security engines, and it appears on at least one external blocklist, with PhishDestroy actively blocking it. The combination of brand impersonation, a convincing page title, and the presence of a valid SSL certificate is typical of credential‑harvesting campaigns targeting cryptocurrency users. Defenders should continue to block the domain at perimeter firewalls, DNS filtering solutions, and endpoint protection tools.

Monitoring for other domains that resolve to the same IP range or share the Vercel DNS configuration may reveal additional malicious extensions. Because the site is presently offline, any active phishing payloads would need to be served from a different host, so threat‑intel teams should correlate recent reports of Coinbase‑related scams with this infrastructure to identify potential re‑use. Regularly updating URL filtering lists with the observed indicators will reduce exposure to similar brand‑impersonation attempts.