coimbase-ext-en-c-auth[.]created[.]app

The domain coimbase-ext-en-c-auth.created.app was registered on July 12, 2023 through Tucows Domains Inc. and resolves to IP address 216.150.1.193, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. The hosting environment is identified as Vercel, as indicated by the detected technologies and the authoritative name servers ns1.vercel-dns.com and ns2.vercel-dns.com. The site presents an HTTPS certificate issued by Let’s Encrypt (R13) and enforces HSTS, yet the HTTP response returns a 404 status code, suggesting the content has been removed or is otherwise inaccessible. Google Safe Browsing has flagged the domain for social engineering, and the page title returned by the server is "Coinbase Wallet Extension," directly referencing the targeted brand.

The domain is classified as a crypto‑related scam and is listed as impersonating Coinbase. Security telemetry shows that 11 of 95 antivirus and URL reputation engines on VirusTotal flag the domain as malicious, and it appears on one external security blocklist. PhishDestroy has taken the domain offline, and the current status is reported as offline.

Defenders should treat this indicator as high‑risk: block the domain at perimeter firewalls and DNS resolvers, add it to internal threat intelligence feeds, and monitor for any related sub‑domains or variations that may leverage the same Vercel infrastructure. Users should be reminded to verify the authenticity of any Coinbase‑branded extensions and to avoid clicking links that reference this domain. Continuous monitoring of the associated IP range and the registrar’s new registrations is recommended to detect potential re‑use of the same infrastructure for future impersonation campaigns.