wllt-extnsion-coinbase-es[.]created[.]app

The domain wllt-extnsion-coinbase-es.created.app is flagged as a brand impersonation site targeting Coinbase. Infrastructure analysis shows the domain resolves to IP address 216.150.1.193, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain is hosted on Vercel, as indicated by the presence of Vercel DNS records (ns1.vercel-dns.com, ns2.vercel-dns.com) and the detection of Vercel technology and HTTP Strict Transport Security (HSTS) on the server. A Let's Encrypt R13 certificate secures the site, confirming the use of a publicly available TLS certificate.

The HTTP response currently returns a 404 status, and the domain is listed as offline by the reporting source. The page title retrieved from the domain—"Coinbase Wallet Extension Features Explained: Secure Crypto & NFT Management"—explicitly references Coinbase, reinforcing the impersonation claim. Registration data indicates the domain was created on July 12, 2023 through Tucows Domains Inc., a registrar commonly used for disposable or short‑lived malicious domains. The domain appears on one security blocklist and has been blocked by PhishDestroy.

VirusTotal scans show eight of ninety‑five security vendors flagged the domain, providing additional corroboration of malicious intent. The threat is categorized as a crypto scam, and the risk level is elevated. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection attempts, and update threat intelligence feeds with the observed indicators of compromise, including the IP address, SSL certificate thumbprint, and the specific page title string. Ongoing vigilance is advised given the potential for re‑use of the same hosting infrastructure for future impersonation campaigns.