coinbase-extension-world[.]created[.]app

The domain coinbase-extension-world.created.app was registered on July 12, 2023 through Tucows Domains Inc. and currently resolves to the IP address 216.150.1.129, which is hosted in the United States under ASN 16509 owned by Amazon.com, Inc. The site is built on the Vercel platform, as indicated by the presence of Vercel DNS nameservers (ns1.vercel-dns.com and ns2.vercel-dns.com) and the detection of Vercel technology during analysis. TLS is provided by a Let’s Encrypt certificate (R13) and the site enforces HSTS, suggesting an attempt to portray a legitimate HTTPS service. The HTTP response for the root URL returns a 404 status, and the page title retrieved from the server is "Official Site™ | Coinbase Extension™ Secure Your Account With Coinbase," explicitly referencing Coinbase and attempting to lure users into a crypto‑related scam.

The domain is categorized as a brand‑impersonation threat targeting Coinbase and is associated with a crypto scam vector. Threat intelligence feeds have flagged the domain on one security blocklist, and PhishDestroy has confirmed it as blocked. VirusTotal scans show that seven of ninety‑five security vendors flagged the domain, indicating moderate detection confidence.

The domain is presently offline, and its risk level is listed as elevated. Defenders should add the domain to URL filtering and DNS blocklists, monitor the associated IP range for any resurgence, and treat any future resolution of the same host‑name as suspicious. Continuous observation of Vercel‑hosted domains that reference Coinbase in page titles is advised, as the infrastructure could be repurposed for new campaigns.