coinbase-chromextension[.]created[.]app

Analysis of the domain coinbase-chromextension.created.app confirms it as a high-risk crypto scam targeting Coinbase users. The domain, registered on July 12, 2023, through Tucows Domains Inc., was taken offline by July 23, 2026, following detection by multiple security mechanisms. Infrastructure analysis reveals the site was hosted on Amazon Web Services (AS16509) at IP 216.150.16.129, located in the US, and utilized Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com). The SSL certificate was issued by Let's Encrypt (R13), and HTTP Strict Transport Security (HSTS) was enabled, though these measures do not mitigate the site's malicious intent.

The page title, 'Coinbase Chrome Extension | Secure Browser Wallet Access,' explicitly impersonates Coinbase, a well-known cryptocurrency exchange, aligning with the scam type labeled as 'Crypto Scam.' Google Safe Browsing flagged the domain for social engineering, and it appeared on at least one security blocklist (PhishDestroy). Twelve of 95 security vendors on VirusTotal detected the domain as malicious, further corroborating its fraudulent nature. The HTTP status returned a 404 at the time of assessment, indicating the site was no longer accessible, though this does not preclude future reactivation under the same or similar infrastructure. Defenders should treat this domain as a confirmed threat vector for cryptocurrency fraud.

Indicators of compromise include the domain itself, its resolved IP (216.150.16.129), and associated nameservers. Organizations should block or monitor traffic to this domain and its IP, particularly in environments where Coinbase-related services are used. Given the domain's history and detection by multiple vendors, it is advisable to investigate any prior connections from internal networks to this infrastructure.