us-coinbse-extnsion[.]created[.]app

The domain us-coinbse-extnsion.created.app is a fraudulent site designed to impersonate the legitimate cryptocurrency exchange Coinbase. The page title matches the domain, indicating an attempt to deceive users into believing it is an official Coinbase browser extension or service. The primary threat is credential theft and cryptocurrency wallet compromise, as victims may be tricked into entering login credentials or private keys under the guise of a software extension.

Technical analysis confirms the malicious nature of this domain. VirusTotal reports 12 detections out of 95 vendors. It is flagged by ChainPatrol, alphaMountain.ai, CyRadar, Ermes, and ESET, and appears on one blocklist. The domain was registered on 2023-07-12 through Tucows Domains Inc. and resolves to IP address 216.150.1.193, hosted in the United States by Amazon.com, Inc. (AS16509). It uses a Let's Encrypt SSL certificate (issuer R13) and nameservers ns1.vercel-dns.com and ns2.vercel-dns.com.

As of the current assessment, the site is offline and unreachable. The risk level is moderate to high due to the impersonation of a major brand and the presence of multiple security vendor flags. Users who previously interacted with the site should treat their accounts as potentially compromised and change credentials immediately.