en-coinbase-exten[.]created[.]app

en-coinbase-exten.created.app was registered through Tucows Domains Inc. on July 12, 2023. The site presented the page title “Coinbase Browser Extension: Your Secure Gateway to Crypto,” directly referencing Coinbase and indicating a crypto‑scam impersonation. The SSL certificate was issued by Let’s Encrypt (R13) and the site employed HSTS, suggesting an attempt to appear legitimate. Hosting was provided by Vercel, as indicated by the presence of Vercel DNS nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the Vercel technology fingerprint.

The domain resolved to IP 216.150.1.1, an address owned by Amazon.com, Inc. (AS16509) located in the United States. VirusTotal analysis recorded 12 detections out of 95 security vendors, confirming malicious classification. Google Safe Browsing flagged the domain for social engineering, and PhishDestroy listed it on its blocklist, making the domain appear on at least one security blocklist. An HTTP request to the site returned a 404 status, and the domain is currently taken offline.

The available evidence demonstrates a high‑risk, brand‑impersonation infrastructure targeting Coinbase users with a crypto‑scam narrative. However, the site is no longer reachable, limiting direct observation of the payload or credential‑harvesting mechanisms. Defenders should continue to block the domain at network perimeters, update URL‑filtering and email‑security policies to include the exact hostname, and monitor for other Vercel‑hosted subdomains that share the same registrar or IP range. Ongoing vigilance is advised because the attacker may reactivate the domain or replicate the infrastructure using similar naming conventions.