coinbase-org[.]created[.]app

The domain coinbase-org.created.app was registered on July 12, 2023 through Tucows Domains Inc. and is currently marked offline. DNS resolution points to IP address 216.150.1.193, which belongs to Amazon.com, Inc. (AS16509) and is hosted on the Vercel platform, as indicated by the presence of Vercel DNS nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the detection of Vercel technology. The site served an HTTP 404 response and presented a TLS certificate issued by Let’s Encrypt (R13). HSTS was observed, suggesting the domain attempted to enforce secure connections.

The page title retrieved from the site reads "Coinbase Extension - Secure Crypto Trading Browser Extension | Official Download", explicitly referencing Coinbase and describing a browser extension for crypto trading. The brand target is identified as Coinbase, and the scam classification is listed as a Crypto Scam, confirming that the domain was used to impersonate the legitimate brand. Reputation services show mixed signals: Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 11 of 95 scanned security vendors flagged the domain as malicious. The domain appears on one security blocklist and is blocked by PhishDestroy, reinforcing its malicious reputation.

While the HTTP status is a 404, the presence of a brand‑specific title and the TLS configuration indicate that the domain was, at some point, intended to lure victims into downloading a counterfeit extension. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the host on the same IP range, and update detection signatures to include the observed page title and certificate details. Additional investigation of the associated IP and any related Vercel deployments may reveal further infrastructure used in the campaign.