coinbase-ext-io[.]created[.]app

Analysis shows that coinbase-ext-io.created.app resolves to the Amazon‑owned address 216.150.1.1, located in the United States and announced as part of ASN 16509. The domain was registered through Tucows Domains Inc. on July 12, 2023 and is hosted on Vercel infrastructure, as indicated by the presence of ns1.vercel-dns.com and ns2.vercel-dns.com as authoritative name servers and by the detection of Vercel and HSTS in the technology fingerprint. The site presents the page title "Coinbase Pro Extension|| Streamlined Trading", explicitly referencing the Coinbase brand and suggesting a financial‑trading service. Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has already blocked the domain.

VirusTotal reports that 11 of 95 scanned security vendors flag the domain, and it appears on a single external blocklist. An SSL certificate issued by Let’s Encrypt (R13) is active, but the HTTP response currently returns a 404 status code and the site has been taken offline. The combined evidence points to an investment‑scam campaign that impersonates Coinbase, leveraging a convincing brand name in the title to lure victims.

Uncertainty remains regarding the exact payload or credential‑collection mechanism because the site is no longer reachable for content inspection. Defenders should add the domain to blocklists, monitor DNS queries for 216.150.1.1 associated with Vercel name servers, enforce URL filtering based on the Google Safe Browsing and PhishDestroy listings, and consider reviewing any outbound connections to the IP for potential exfiltration. Continuous telemetry on similar Vercel‑hosted domains targeting financial brands is recommended to catch variants that may reuse the same infrastructure.