coinbase-us[.]created[.]app

Analysis indicates that the domain coinbase-us.created.app was registered through Tucows Domains Inc. on July 12, 2023. The domain resolves to the IP address 216.150.1.193, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. DNS resolution uses Vercel name servers (ns1.vercel-dns.com, ns2.vercel-dns.com), and the site was served over HTTPS with a Let’s Encrypt R13 certificate that includes HTTP Strict Transport Security. A request to the root URL returns HTTP status 404, and the page title presented by the server reads “Coinbase Extension - Secure Crypto Trading Browser Extension | Download Free”, explicitly referencing the Coinbase brand.

Google Safe Browsing classifies the URL as a social engineering threat, and ten of ninety‑five VirusTotal scanners have flagged the domain as malicious. The site has been added to a single security blocklist and is presently blocked by the PhishDestroy feed. The threat profile is labeled as a crypto‑related scam that impersonates Coinbase, aligning with the brand‑impersonation strategy observed in other cryptocurrency phishing campaigns. At the time of assessment the domain is offline, which limits current content analysis, but the combination of brand‑specific page title, SSL configuration, hosting on a major cloud provider, and multiple vendor detections provides sufficient evidence of malicious intent.

Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any future activation, and consider adding the URL to internal threat‑intelligence feeds. Ongoing observation of the hosting provider and registrar may reveal re‑use of the infrastructure for new campaigns. Until the site is taken down permanently, organizations should educate users about unsolicited requests to install browser extensions claiming to be from Coinbase.