coinbasewallet-secure[.]created[.]app

This domain, coinbasewallet-secure.created.app, presents a confirmed brand impersonation threat targeting users of the Coinbase cryptocurrency platform. Analysis indicates the site mimics the legitimate Coinbase Wallet Browser Extension, using the page title 'Coinbase Wallet Browser Extension – Safe Web3 Access' to deceive visitors into believing they are accessing an official service. The objective of this campaign appears to be credential theft, where victims may unknowingly submit sensitive authentication details, such as wallet credentials or private keys, to attackers. Given the high-risk nature of cryptocurrency-related fraud, this domain poses a significant threat to both individual users and institutional stakeholders relying on secure Web3 access. Evidence supporting this assessment includes detection by 11 out of 95 security vendors on VirusTotal, with the domain also appearing on one security blocklist. Infrastructure analysis reveals the domain was registered on July 12, 2023, through Tucows Domains Inc., and resolves to the IP address 216.150.1.65, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The SSL certificate is issued by Let's Encrypt (R13), a common tactic among threat actors to lend a false sense of legitimacy. Google Safe Browsing has also flagged this domain as phishing, further corroborating its malicious intent. Users who visited coinbasewallet-secure.created.app should immediately revoke any credentials or private keys entered on the site. It is recommended to monitor associated accounts for unauthorized transactions and enable multi-factor authentication where available. Affected individuals should also scan their systems for malware, as phishing sites may deploy additional payloads. Given the domain's current offline status, users are advised to remain vigilant for similar impersonation attempts, particularly those leveraging cryptocurrency wallet extensions or urgent security prompts.