coinbase-wallat-extnsn[.]wasmer[.]app

The domain coinbase-wallat-extnsn.wasmer.app is identified as a brand impersonation threat targeting Coinbase. It is designed to deceive users into believing they are interacting with a legitimate Coinbase service, potentially leading to the theft of sensitive information or financial loss.

Infrastructure analysis reveals that the domain was created on October 16, 2018, and is registered through Squarespace Domains II LLC. It resolves to the IP address 62.210.172.150, which is located in France and is part of the AS12876 SCALEWAY S.A.S. network. The domain has been flagged by 15 out of 95 security vendors on VirusTotal, suggesting a moderate to high level of malicious activity. Additionally, the domain appears on 1 security blocklist, further indicating its malicious nature. The SSL certificate is issued by Let's Encrypt, with the serial number E7.

Currently, the domain is offline, which reduces the immediate risk to potential victims. However, the domain's history and current blocklist status suggest that it has been used for malicious purposes in the past. Organizations and individuals should remain vigilant and ensure that any links or communications related to Coinbase are verified through official channels. The domain's offline status does not guarantee that it will not be reactivated, so continuous monitoring is recommended. Actions taken include the domain being blocked by PhishDestroy, a security blocklist, which helps mitigate the risk of future attacks. Despite the domain being offline, the risk remains elevated due to the potential for reactivation and the historical evidence of malicious activity.