coinbasextension[.]created[.]app

coinbasextension.created.app is currently offline, returning HTTP 404 for all requests. The domain was registered on July 12, 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.1.129, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. DNS resolution is handled by ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the site was hosted on the Vercel platform. Vercel‑provided headers reveal that HTTP Strict Transport Security (HSTS) is enabled, and the TLS certificate is issued by Let’s Encrypt (R13).

The page title observed during a brief fetch was “Coinbase Extension – Secure Crypto Access & Tools”, directly referencing the Coinbase brand. Google Safe Browsing classifies the domain as a social engineering threat, and it appears on a single security blocklist, where it is listed by PhishDestroy. VirusTotal scans show that eight out of ninety‑five antivirus engines flagged the domain, reinforcing the suspicion of malicious activity. The threat profile is identified as a crypto‑related scam that impersonates Coinbase, matching the “brand impersonation” and “crypto scam” descriptors supplied.

Because the site is no longer reachable, active payloads cannot be confirmed, and the exact phishing kit or landing page content remains unknown. Defenders should continue to block the domain at network perimeter and update any URL filtering policies to include coinbasextension.created.app. Monitoring of the associated IP address and the Vercel nameservers for future activity is advised, as threat actors may reuse the same hosting environment for new campaigns. Incident response teams should also consider checking for recent email or messenger campaigns that reference a “Coinbase Extension” to correlate potential user exposure.