coin-base-extension[.]weebly[.]com

The domain coin-base-extension.weebly.com is currently listed as offline, returning an HTTP 404 status code, but forensic traces reveal a high‑risk brand‑impersonation campaign targeting Coinbase users. Registration details show the domain was created on March 29 2006 and is managed through Safenames Ltd., while the hosting resides on the Weebly infrastructure (AS27647) with the IPv4 address 74.115.51.9 located in the United States. The domain resolves to four Amazon Route 53 name servers (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns), confirming the use of AWS DNS services. Cloudflare is detected as a front‑end technology, and the site presents a Let’s Encrypt/E8 TLS certificate, indicating the presence of a valid, publicly trusted SSL certificate despite its malicious intent.

The page title observed during the brief availability – “Coinbase Extension™ | Secure Browser Access to Your Crypto Tools” – directly references Coinbase, aligning with the documented scam type of a crypto‑related impersonation. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports 14 detections out of 93 scanning engines, demonstrating a consensus among security vendors that the site is malicious. The domain appears on a single security blocklist and is specifically blocked by PhishDestroy, reinforcing its classification as a phishing vector.

While the site is offline, the infrastructure footprint (IP address, hosting AS, DNS configuration, SSL certificate) remains actionable for defenders. Organizations should continue to deny connections to the IP 74.115.51.9, include the full domain in web‑filtering and DNS‑sinkhole policies, and monitor related AWS name‑server patterns for potential re‑use.