coinbase-ext-en-c-auth[.]created[.]app

On 12 July 2023 the domain coinbase-ext-en-c-auth.created.app was registered through Tucows Domains Inc. The domain resolves to 216.150.1.193, an address owned by Amazon.com, Inc. (AS16509) located in the United States. DNS resolution is served by ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the site was hosted on Vercel’s platform. The site presented an SSL certificate issued by Let’s Encrypt (R13) and forced HTTP Strict Transport Security (HSTS), which is typical for legitimate services but does not guarantee authenticity. When queried, the HTTP response returned a 404 status, and the site is currently taken offline.

The page title returned by the server was “Coinbase Extension | Secure Browser Wallet for Crypto & Web3”, explicitly referencing Coinbase and suggesting a browser‑based cryptocurrency wallet. The domain is listed on a single security blocklist and is blocked by the PhishDestroy filtering service. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal recorded detections from ten of ninety‑five scanned scanners, reinforcing the malicious intent. The overall classification in intelligence reports is a crypto‑related scam impersonating Coinbase.

Analysis indicates that the threat actors leveraged a legitimate‑looking domain suffix (“created.app”) and a convincing page title to lure victims seeking a Coinbase browser extension. The use of Vercel infrastructure and a Let’s Encrypt certificate helps evade superficial reputation checks, while the 404 response suggests the malicious page may have been removed or is dynamically generated. Defenders should continue to block the domain at network perimeters, update URL filtering lists with the observed host, and monitor for any resurgence of the same host or similar sub‑domains using the same registrar or Vercel nameservers.