coinbase-extension-en[.]created[.]app

On July 24, 2026 analysts recorded the domain coinbase-extension-en.created.app as a high‑risk brand‑impersonation site targeting Coinbase users. The domain was registered through Tucows Domains Inc. on July 12, 2023 and is currently offline; the HTTP response returned a 404 status code before takedown. Infrastructure analysis shows the domain resolves to IP address 216.150.1.1, hosted in the United States under ASN 16509 (Amazon.com, Inc.). The associated SSL certificate is issued by Let’s Encrypt (R13), and the site employed Vercel hosting with HTTP Strict Transport Security (HSTS) enabled.

Nameserver records point to ns1.vercel-dns.com and ns2.vercel-dns.com. Reputation checks indicate that Google Safe Browsing classified the site as a social‑engineering threat, and the domain appears on one external security blocklist. VirusTotal scanned the site and 11 of 95 antivirus engines flagged it as malicious, reinforcing the suspicion of a crypto‑scam payload. PhishDestroy has also added the domain to its blocklist.

The page title observed during collection was “Coinbase Extension | Secure Browser Wallet for Easy Crypto Access,” confirming the intent to masquerade as an official Coinbase browser extension. While the exact content of the landing page has not been publicly released, the combination of brand impersonation, a crypto‑wallet narrative, and the detection profile suggests a targeted attempt to harvest credentials or lure victims into fraudulent cryptocurrency transactions. Defenders should continue to block the domain at DNS and proxy layers, monitor for any residual traffic to the resolved IP, and update endpoint and email filters with the observed indicators of compromise. Ongoing vigilance is recommended, especially for users of Coinbase services, to prevent credential compromise or financial loss.