coinbse-wallet-ext[.]created[.]app

Analysis of the domain coinbse-wallet-ext.created.app indicates a brand impersonation campaign targeting Coinbase, a cryptocurrency exchange platform. The domain was registered on July 12, 2023, through Tucows Domains Inc. and resolves to the IP address 216.150.1.193, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Nameservers ns1.vercel-dns.com and ns2.vercel-dns.com suggest the use of Vercel hosting services, a detail further supported by the detection of Vercel technologies on the site. The domain's page title, 'Coinbase Wallet Extension - Secure Crypto Wallet for DeFi & Web3 | Download Now,' explicitly impersonates Coinbase's branding and functionality, aligning with the scam type classified as a crypto scam. As of the report date, the domain returns an HTTP 404 status, indicating it is currently offline or inaccessible.

However, prior activity is evidenced by its presence on one security blocklist and its flagging by Google Safe Browsing for social engineering. Nine of 95 security vendors on VirusTotal have flagged this domain, reinforcing its classification as malicious. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its accessibility. The use of HTTP Strict Transport Security (HSTS) does not mitigate the domain's malicious intent, as this security feature is often employed to lend an appearance of legitimacy. Defenders should treat this domain as a confirmed threat vector for crypto-related fraud.

Network-level blocking of the IP 216.150.1.193 and the domain itself is recommended. Given the domain's registration date and its current offline status, it may represent a dormant or decommissioned campaign, but historical indicators should be retained for retrospective threat hunting. Further investigation into associated infrastructure, such as other domains hosted on the same IP or utilizing the same nameservers, may uncover additional malicious activity.