coinbase-extensiion-cloud[.]created[.]app

The domain coinbase-extensiion-cloud.created.app is identified as a high-risk brand impersonation threat targeting Coinbase. The domain was created on July 12, 2023, and is designed to deceive users into believing they are accessing a legitimate Coinbase service. The page title found is 'Install Coinbase Wallet Extension | Explore dApps & Crypto Safely', which mimics the official Coinbase extension installation process to trick users into divulging sensitive information.

Analysis indicates that the domain has been flagged by 17 out of 95 security vendors on VirusTotal, a significant detection rate that underscores the domain's malicious intent. The domain is registered through Tucows Domains Inc. and was created on July 12, 2023. The SSL certificate is issued by Let's Encrypt, which is often used by threat actors to gain user trust. The domain resolves to the IP address 216.150.1.65, located in the United States and associated with AS16509 Amazon.com, Inc. The domain appears on one security blocklist, further confirming its malicious nature.

If users have visited coinbase-extensiion-cloud.created.app, they should immediately check their Coinbase accounts for any unauthorized activity. It is recommended that they change their passwords and enable two-factor authentication (2FA) to enhance account security. Additionally, users should monitor their financial transactions and report any suspicious activity to their financial institutions and Coinbase support. Users are advised to always verify the domain and URL before entering any personal or financial information online.