conbase-en-extension[.]created[.]app

The domain conbase-en-extension.created.app was registered on July 12, 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.16.129, an Amazon.com, Inc. (AS16509) host located in the United States. The site is hosted on Vercel infrastructure, as indicated by the presence of Vercel DNS name servers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the detection of Vercel technology. TLS termination is provided by a Let’s Encrypt R13 certificate and the site enforces HTTP Strict Transport Security (HSTS). The page title observed during a brief probe reads “Coinbase Wallet | Getting Started: Wallet Extension,” directly referencing the Coinbase brand.

Google Safe Browsing classifies the URL as a social engineering threat, and VirusTotal records nine detections out of ninety‑five scanners, suggesting moderate malicious activity. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service. Current probing shows the site is offline and returns an HTTP 404 status, indicating that the malicious content has been taken down or is otherwise unavailable at the time of analysis.

The combination of brand impersonation, a crypto‑focused scam label, and the presence of multiple security vendor flags points to a credential‑harvesting or wallet‑draining campaign targeting Coinbase users. Defenders should continue to monitor the IP address 216.150.16.129 for any re‑activation, enforce URL filtering for the exact domain and its subdomains, and ensure that endpoint protection solutions incorporate the latest threat intel from the listed vendors. Network administrators should also consider updating internal blocklists to include this domain, while SOC analysts should correlate any alerts involving Coinbase‑related login attempts with this indicator to identify potential compromise attempts.