coenbase-extension-web3[.]created[.]app

Analysis of coenbase-extension-web3.created.app indicates a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered on July 12 2023 through Tucows Domains Inc. and is hosted on Amazon’s AS16509 infrastructure, resolving to 216.150.16.129 in the United States. The site is served via Vercel, employs HSTS, and presents a valid Let's Encrypt R13 certificate, which may lend an appearance of legitimacy. The HTTP response is a 404 error, and the page title returned by the server reads “Coinbase Extension – Your Gateway to Web3,” explicitly referencing the Coinbase brand and the Web3 ecosystem, consistent with the listed scam type of a crypto scam.

Google Safe Browsing classifies the domain as social engineering, and 11 of 95 VirusTotal scanners have flagged it, confirming malicious intent. PhishDestroy has taken the domain offline, and it appears on a single security blocklist. The nameservers ns1.vercel‑dns.com and ns2.vercel‑dns.com correspond to the Vercel hosting platform. The available evidence confirms that the domain is being used to impersonate Coinbase, likely to lure victims into installing a malicious browser extension or disclosing cryptocurrency credentials.

No additional content has been retrieved, and the 404 status prevents direct inspection of the payload, leaving the exact phishing vector uncertain. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the resolved IP, and add the domain to internal blocklists. Incident response teams should also watch for related indicators such as the Vercel nameservers and the specific page title string. Ongoing telemetry should be collected to detect any re‑activation attempts, and users should be warned that any unsolicited “Coinbase Extension” link is likely fraudulent.