coinbase-chrme-exten[.]created[.]app

This domain, coinbase-chrme-exten.created.app, was registered through Tucows Domains Inc. on 12 July 2023 and resolves to the Amazon Web Services address 216.150.1.129 (AS16509, United States). The hosting infrastructure is identified as Vercel with HSTS enabled, and the site presented a Let’s Encrypt R13 certificate. The page title retrieved from the now‑offline host reads “Coinbase Chrome Extension – Web3 Wallet”, indicating a crypto‑wallet extension narrative that directly references the Coinbase brand. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single external blocklist, specifically PhishDestroy, which has actively blocked it.

VirusTotal analysis shows ten of ninety‑five scanning engines flagging the domain, reinforcing the malicious assessment. The site returned an HTTP 404 status at the time of observation, and the current status is offline, suggesting the operator has removed the public content. The available evidence points to a high‑risk crypto‑scam campaign that leverages Coinbase brand impersonation to lure victims into installing a purported Chrome extension. While the exact payload or credential‑harvesting mechanism cannot be confirmed without live content, the combination of brand‑targeted page title, social‑engineering classification, and multiple security‑vendor detections indicates a deliberate attempt to deceive users.

Defenders should add the domain and its associated IP address to internal block lists, monitor for future DNS resolutions to the same IP range, and enforce strict validation of Chrome extension sources in enterprise environments. Continuous observation of the registrar (Tucows) and the Vercel DNS records is advised, as the threat actor may recreate the site under a similar naming pattern. Organizations employing Coinbase services should educate users about unsolicited extension requests and encourage verification through official channels.