coinbase-extenson-web3[.]created[.]app

coinbase-extenson-web3.created.app was registered through Tucows Domains Inc. on July 12, 2023. The site resolves to the IPv4 address 216.150.1.1, which is announced by Amazon.com, Inc. (AS16509) and geolocated to the United States. Passive analysis shows the hosting platform uses Vercel and the domain enforces HTTP Strict Transport Security. The TLS certificate is issued by Let’s Encrypt (R13), indicating a valid, automated certificate chain.

VirusTotal records indicate that 10 of 95 scanned security vendors flagged the domain as malicious, and Google Safe Browsing classifies it as a social‑engineering threat. The page title returned by the server is “How to Install and Use the Coinbase Extension – Step‑by‑Step Tutorial”, and the domain is listed as impersonating Coinbase in a crypto‑scam context. HTTP response code 404 demonstrates that the content is no longer accessible, and the domain has been taken offline, with PhishDestroy reporting it as blocked. The domain appears on a single security blocklist, and its authoritative nameservers are ns1.vercel‑dns.com and ns2.vercel‑dns.com.

While the exact phishing page content cannot be recovered, the combination of brand impersonation, malicious detection counts, and hosting on a widely used cloud platform suggests a high‑risk credential‑harvesting operation. Defenders should add the domain and its resolved IP address to outbound and inbound blocklists, monitor other subdomains under the same registrar and hosting provider, and enforce strict verification of any Coinbase‑related extension requests. Ongoing telemetry collection is recommended to detect re‑use of the Vercel DNS infrastructure for similar campaigns.