coiinbase-extenson-web3[.]created[.]app

The domain coiinbase-extenson-web3.created.app is flagged as a high‑risk brand‑impersonation site targeting Coinbase users. Registration data indicates the domain was created on July 12, 2023 through Tucows Domains Inc., and it resolves to IP address 216.150.1.1, an Amazon.com, Inc. host located in the United States (AS16509). DNS resolution uses Vercel name servers (ns1.vercel-dns.com, ns2.vercel-dns.com), and the site served a Let’s Encrypt certificate (R13) with HSTS enabled. Automated scans returned an HTTP 404 status, suggesting the malicious landing page is no longer accessible, and the site has been taken offline.

The page title observed during earlier crawls was "Coinbase Extension Review: Features, Benefits & Web3 Access," which aligns with the declared scam type of a crypto scam and the impersonation of Coinbase. Google Safe Browsing classified the URL as social engineering, and VirusTotal recorded 13 detections out of 95 scanned engines, reinforcing the malicious assessment. The domain appears on one public blocklist and is blocked by the PhishDestroy service. Infrastructure analysis shows no additional services beyond Vercel hosting, and no further evidence of credential‑stealing forms or malicious binaries has been disclosed.

Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the site on the same IP or name server pair, and advise users to disregard any unsolicited communications referencing a Coinbase extension review. Threat intelligence feeds should update indicator lists with the domain, its IP, and associated SSL fingerprint to improve detection coverage. Uncertainty remains regarding the exact content of the removed page and whether the operators have redeployed the campaign on a new host, so continuous observation of similar Vercel‑hosted subdomains is recommended.