coinbase-wallet-eng-exteension[.]created[.]app

Analysis of coinbase-wallet-eng-exteension.created.app indicates that the domain is actively leveraged for brand impersonation targeting Coinbase users. The domain was registered on July 12, 2023 through Tucows Domains Inc. and resolves to IP address 216.150.1.129, which is part of Amazon.com, Inc. (AS16509) hosted in the United States. Infrastructure clues reveal deployment on Vercel with HSTS enforced and a Let’s Encrypt R13 certificate, suggesting a legitimate hosting platform was abused to lend credibility. The site returns an HTTP 404 status, and the page title captured during a brief fetch is "Coinbase Wallet Extension – Web3 Access Tool," directly mirroring Coinbase branding and confirming the crypto‑scam classification.

Google Safe Browsing flags the domain for social engineering, and it appears on a single security blocklist as well as PhishDestroy’s blocklist. VirusTotal scans show eight of ninety‑five antivirus engines flag the domain, reinforcing its malicious reputation. Current operational status is offline, but the historical evidence demonstrates a purposeful attempt to deceive users seeking a Coinbase wallet extension. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the exact FQDN, and update web filtering rules to include the associated IP range.

Threat intelligence feeds should be enriched with the registrar, hosting, and SSL details to improve correlation with other Vercel‑based impersonation campaigns. Because the site is no longer reachable, the immediate risk is reduced, yet the pattern of using reputable cloud services for phishing persists, and future variants may reuse similar naming conventions. Continuous vigilance and rapid feed propagation are advised.