portal-coin-base-ext[.]created[.]app

The domain portal-coin-base-ext.created.app was registered through Tucows Domains Inc. on July 12, 2023 and is presently taken offline. Infrastructure analysis shows the domain resolves to IP address 216.150.16.129, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The host is served by Vercel, as indicated by the detected technologies, and the site enforces HTTP Strict Transport Security (HSTS). The SSL certificate is issued by Let’s Encrypt under the R13 profile, confirming the use of a publicly trusted certificate authority. The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, consistent with Vercel‑hosted deployments.

The page title returned by the server is "Coinbase@@ Wallet | Login Extension©©", and the HTTP response code is 404, indicating that the expected content is not currently accessible. VirusTotal reports that eight of ninety‑five scanning engines flagged the domain, and the domain appears on a single external security blocklist. PhishDestroy has also listed the domain as blocked. The campaign is classified as a crypto‑related scam that impersonates the Coinbase brand, targeting users with a fabricated wallet login extension.

While the domain’s offline status limits immediate threat exposure, the combination of a reputable certificate, Vercel hosting, and a brand‑specific page title suggests a deliberate attempt to gain user trust. Defenders should continue to monitor the associated IP address and nameserver infrastructure for re‑activation, update URL filtering and endpoint protection policies to block the domain and its IP, and consider sharing the indicator set with threat‑intelligence platforms to aid broader detection efforts. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as the site returned a 404 response and no further content was captured.