nav-coinbase-extension[.]created[.]app

The domain nav-coinbase-extension.created.app was registered on July 12, 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.1.65, which is hosted by Amazon.com, Inc. (AS16509) in the United States. DNS resolution is provided by Vercel’s authoritative servers ns1.vercel-dns.com and ns2.vercel-dns.com, confirming that the site leverages Vercel infrastructure. The TLS certificate is issued by Let’s Encrypt under the R13 profile and the site enforces HTTP Strict Transport Security, indicating a standard HTTPS configuration despite its malicious intent.

An HTTP request to the root URL returns a 404 status, and the page title retrieved from the server is “Coinbase™ Extension: Your Secure Gateway to Crypto,” directly referencing the Coinbase brand. The domain is classified as a crypto‑related brand impersonation scam and appears on a single security blocklist, with PhishDestroy actively blocking it. VirusTotal analysis shows that 13 of 95 scanning engines flagged the domain as malicious, providing additional corroboration of its threat status.

Current monitoring indicates the site is offline, which may be temporary or a mitigation step by the operators. Defenders should continue to block the domain at network perimeters, update URL filtering rules, and monitor for any re‑appearance or related domains using the same registrar or hosting provider. Evidence from the page title, SSL details, Vercel hosting, and vendor detections collectively substantiate the domain’s role in brand impersonation targeting Coinbase users.