coinbase-wallet-extn[.]created[.]app

The domain coinbase-wallet-extn.created.app was registered on July 12, 2023 through Tucows Domains Inc. and is hosted on Amazon’s AS16509 network, resolving to IP address 216.150.16.65 located in the United States. DNS resolution is delegated to Vercel’s name servers (ns1.vercel-dns.com, ns2.vercel-dns.com), and the site advertises Vercel as its underlying technology stack and enforces HTTP Strict Transport Security. The TLS certificate is issued by Let’s Encrypt (R13), indicating a valid HTTPS endpoint at the time of observation. An HTTP request to the root URL returned a 404 status code, and the domain has been taken offline, consistent with the current status indicator.

The page title retrieved from the site reads “coinbase wallet | Download security defi Extension,” directly referencing the Coinbase brand and suggesting a crypto‑related download. The threat classification is a brand impersonation aimed at Coinbase, falling under the broader crypto scam category. Detection services have flagged the domain: Google Safe Browsing reports a social‑engineering warning, PhishDestroy has listed it as blocked, and it appears on one external security blocklist. VirusTotal analysis shows nine of ninety‑five scanners flagging the domain as malicious, providing additional corroboration of threat.

No further content analysis is available beyond the page title, leaving the exact payload or credential‑harvesting mechanisms unconfirmed. Defenders should add the domain and its resolving IP to deny‑list rules, monitor for any re‑use of the same hosting infrastructure, and consider broader brand‑specific alerts for Coinbase‑related impersonation attempts. Continuous re‑scanning is advised to capture any future changes if the domain becomes active again.