cointension[.]created[.]app

This report details a malicious domain, cointension.created.app, which poses a significant threat as a cryptocurrency phishing site. The page title, "Coinbase Extension – Secure Crypto Wallet Access," and the reported brand impersonation of Coinbase indicate the site was designed to deceive users into believing it is a legitimate Coinbase platform. The primary threat is credential theft and cryptocurrency asset compromise through social engineering, as the site mimics a secure wallet access interface.

Technical evidence confirms the malicious nature of this domain. VirusTotal analysis shows 9 out of 95 vendors flagged the site. Google Safe Browsing flagged it for SOCIAL_ENGINEERING. It is listed on one blocklist and flagged by ChainPatrol, alphaMountain.ai, Chong Lua Dao, CyRadar, and ESET. The domain was registered through Tucows Domains Inc., created on 2023-07-12, and hosted on IP address 216.150.16.1 in the United States (AS16509 Amazon.com, Inc.). The SSL certificate is issued by Let's Encrypt (R13), and nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com.

The current status is DOWN/OFFLINE, meaning the site is not accessible. Despite being offline, the risk level remains high due to the confirmed impersonation of a major cryptocurrency brand and active security vendor detections. Users who previously encountered this domain should consider their credentials compromised and take immediate security actions.