action-coinbase-exten[.]created[.]app

The domain action-coinbase-exten.created.app was registered on July 12, 2023 through Tucows Domains Inc. and is presently taken offline as of the report date. It resolves to the IP address 216.150.1.193, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States. The site presents a page title of "Getting Started: Wallet Extension - Coinbase Extension," directly referencing the Coinbase brand, and is classified as a crypto‑related scam. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has already blocked it.

VirusTotal analysis shows that 12 out of 95 security vendors have marked the domain as malicious, indicating a moderate level of detection confidence. The domain appears on one external security blocklist, and its SSL certificate is issued by Let’s Encrypt (R13), providing HTTPS with HSTS enabled. Technical fingerprints reveal the use of Vercel hosting and the authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. An HTTP request returns a 404 status, suggesting that the malicious content may be served dynamically or via a redirected endpoint.

While the exact page content has not been publicly disclosed, the combination of brand impersonation, crypto‑scam labeling, and the observed infrastructure points to a targeted credential‑harvesting campaign aimed at Coinbase users. Defenders should immediately add the domain and its resolving IP (216.150.1.193) to network deny lists, monitor for any outbound connections to the AS16509 range, and enforce URL filtering that blocks known Vercel‑hosted phishing hosts. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture any changes in detection status. Organizations should also educate users about the risk of unsolicited wallet‑extension prompts and encourage verification of URLs before entering credentials.