coinbse-wallts-extenson[.]created[.]app

This site, identified by its page title "coinbse-wallts-extenson.created.app," is a fraudulent domain designed to impersonate the legitimate cryptocurrency platform Coinbase. The domain name uses typosquatting (misspelling "Coinbase" as "coinbse" and "wallet" as "wallts") to deceive users into believing it is an official Coinbase extension or wallet service. The primary threat is social engineering, where victims may be tricked into entering sensitive credentials or downloading malicious software under the guise of a trusted brand.

Technical analysis confirms the malicious nature of this domain. VirusTotal reports 10 out of 95 security vendors flagging the site, with detections from ChainPatrol, alphaMountain.ai, CyRadar, ESET, and Fortinet. Google Safe Browsing explicitly flags the site for SOCIAL_ENGINEERING. The domain is registered under Tucows Domains Inc. and was created on 2023-07-12. It resolves to IP address 216.150.16.193, hosted in the United States on AS16509 (Amazon.com, Inc.). The site uses an SSL certificate issued by Let's Encrypt (R13) and nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. Additionally, it appears on one blocklist.

The site is currently offline and down, reducing its immediate threat. However, the risk level remains high due to its impersonation of a major cryptocurrency brand and active flagging by multiple security vendors. Users who may have previously visited the site while it was active should consider their accounts potentially compromised.