coinbase-chrome-exten-sion[.]created[.]app

Analysis indicates that the domain coinbase-chrome-exten-sion.created.app was registered on July 12 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.1.129, which is hosted in the United States under ASN 16509 (Amazon.com, Inc.). The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, and a Vercel hosting fingerprint together with HTTP Strict Transport Security (HSTS) was observed. The site presented a TLS certificate issued by Let’s Encrypt (R13), confirming the use of a valid but freely‑issued certificate. An HTTP request returned a 404 status code, and the page title retrieved was “Coinbase Chrome Extension,” directly referencing the Coinbase brand.

Google Safe Browsing classifies the domain as a social‑engineering threat, and it appears on one external security blocklist. VirusTotal scans show that 12 of 95 antivirus and URL‑reputation engines flagged the domain, reinforcing the suspicion. The domain is currently listed as offline and has been blocked by the PhishDestroy service. The available evidence points to a high‑risk crypto‑scam campaign that impersonates Coinbase to lure victims, likely through a malicious Chrome extension.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no content beyond the title and HTTP status has been captured. Defenders should add the domain to internal blocklists, monitor DNS queries for the associated IP and Vercel nameservers, and enforce domain‑based filtering for any requests to *.created.app. In addition, security teams should update web‑gateway policies to block URLs flagged by Google Safe Browsing and VirusTotal, and consider sharing the indicator set with threat‑intelligence feeds to aid broader community protection.