action-coinbasext[.]created[.]app

Analysis of the domain action-coinbasext.created.app shows multiple indicators of a high‑risk brand‑impersonation operation targeting Coinbase users. The domain was registered on July 12, 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.1.65, an Amazon.com, Inc. (AS16509) host located in the United States. Infrastructure evidence points to a Vercel deployment: the nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, Vercel technology was detected, and the site served an HTTPS certificate from Let’s Encrypt (R13) with HSTS enabled. An HTTP request to the site returned a 404 status, and the domain is currently taken offline, limiting real‑time verification of the content.

However, historical data captured the page title “Coinbase Extension | Getting Started: Wallet Extension,” which aligns with the declared scam type of a crypto scam and confirms the intent to masquerade as a Coinbase wallet extension. Google Safe Browsing flags the domain for social engineering, and the site appears on at least one security blocklist (PhishDestroy). VirusTotal analysis recorded detections from 10 of 95 scanned security vendors, reinforcing the malicious assessment.

The combination of brand impersonation, a crypto‑focused page title, and multiple independent detections indicates a coordinated attempt to lure Coinbase users into installing a fraudulent extension or divulging credentials. Defenders should add the domain and its IP address to blocklists, monitor for any re‑registration or resurrection of the host, and advise end users to disregard any unsolicited Coinbase‑related extension prompts. Ongoing vigilance is recommended, especially for organizations that manage cryptocurrency assets or provide wallet services, to prevent credential harvesting or malware deployment linked to this infrastructure.