coiinbase-exten[.]created[.]app

The domain coiinbase-exten.created.app was registered on July 12 2023 through Tucows Domains Inc. and is hosted on Amazon’s AS16509 network, resolving to 216.150.1.1 in the United States. DNS resolution is handled by Vercel’s nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the site employs Vercel‑provided infrastructure together with HTTP Strict Transport Security. A Let’s Encrypt R13 certificate secures the site, but HTTP requests return a 404 status, indicating that the landing page is no longer available. The page title that was observed before takedown reads “Coinbase EXTENSION – Getting Started: Wallet Extension,” directly linking the content to the Coinbase brand.

Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows eleven of ninety‑five scanners flag the domain, reinforcing the malicious rating. The overall profile matches a crypto‑scam impersonation campaign aimed at luring Coinbase users into a fraudulent wallet extension. Because the site is currently offline, direct forensic evidence from the page content is unavailable, leaving the exact payload and credential‑harvesting mechanisms uncertain.

Defenders should continue to block the domain at perimeter filters, monitor the associated IP range (216.150.0.0/16) for any re‑use, and add the URL to internal threat‑intel feeds. In addition, security teams should advise users that any unsolicited request to install a “Coinbase extension” originating from a URL containing “coiinbase‑exten” is untrusted, and encourage verification through official Coinbase channels. Ongoing reconnaissance of Vercel‑hosted domains that mimic cryptocurrency services is recommended to detect similar impersonation attempts early.