coinbase-extension-secure[.]created[.]app

Analysis of the domain coinbase-extension-secure.created.app indicates a brand-impersonation scam targeting Coinbase users, currently offline as of July 25, 2026. The domain was registered on July 12, 2023, through Tucows Domains Inc. and uses Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com), a common hosting choice for phishing infrastructure. At the time of assessment, the domain resolves to IP 216.150.1.1, hosted on Amazon’s AS16509, though the site returns an HTTP 404 status, suggesting it may have been taken down or is in a dormant state. The page title, 'Coinbase Browser Extension – Manage Crypto Directly Online,' explicitly impersonates Coinbase, a cryptocurrency exchange, aligning with the reported scam type labeled as a 'Crypto Scam.' Google Safe Browsing has flagged the domain for social engineering, and it appears on at least one security blocklist.

Eight out of 95 security vendors on VirusTotal detect the domain as malicious, though the absence of broader detection does not confirm safety. The SSL certificate, issued by Let’s Encrypt (R13), is standard for both legitimate and malicious sites and provides no inherent trust signal. Infrastructure analysis reveals the use of Vercel hosting and HSTS, which are not inherently malicious but are frequently leveraged in phishing campaigns due to their ease of deployment. The domain’s registration details and hosting provider offer no red flags beyond their association with the scam.

Defenders should treat this domain as high-risk for Coinbase users, particularly given its explicit branding and prior classification as a crypto scam. Blocking or monitoring access to this domain is recommended, along with reviewing logs for any prior connections from internal networks. Further investigation into associated IPs, certificates, or related domains may uncover additional infrastructure linked to this campaign.