exxt-coiinbsee-us[.]created[.]app

The domain exxt-coiinbsee-us.created.app was observed as part of a high‑risk brand‑impersonation campaign targeting Coinbase users. Registration records show the name was created on 12 July 2023 through Tucows Domains Inc., and the domain resolves to the IPv4 address 216.150.1.193, which belongs to Amazon.com, Inc. (AS16509) in the United States. Hosting information indicates the site was served via Vercel’s platform, as reflected by the presence of Vercel DNS nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the detection of Vercel technology. The TLS certificate is issued by Let’s Encrypt (R13) and includes HSTS, confirming that the site was capable of delivering HTTPS traffic. An HTTP request returned a 404 status code, suggesting that the landing page is no longer publicly accessible; the domain is currently listed as offline.

Static analysis of the page title revealed the string “Coinbase Extension – Secure Web3 Wallet & DeFi Access,” which directly references Coinbase and attempts to masquerade as a legitimate browser extension. Google Safe Browsing classified the URL as a social‑engineering threat, and ten of ninety‑five VirusTotal scanners flagged the domain as malicious. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service.

Taken together, the infrastructure choices (Vercel front‑end, AWS hosting, Let’s Encrypt TLS) and the brand‑specific title indicate a deliberate attempt to lure cryptocurrency users into installing a malicious extension or divulging credentials. Because the site is already offline, immediate containment actions focus on preventing reuse of the same infrastructure. Defenders should add the IP address 216.150.1.193 to outbound filtering rules, block the domain at DNS resolvers, and monitor for newly registered domains that share the “created.app” suffix and similar Vercel DNS patterns.