coinbaseexten[.]created[.]app

The domain coinbaseexten.created.app is a confirmed phishing site engaged in brand impersonation targeting Coinbase, a major cryptocurrency exchange. This site was designed to deceive users into believing they were interacting with the legitimate Coinbase platform, likely to harvest login credentials or other sensitive information. No cryptocurrency drainer kit was identified in this instance. As of the latest verification, coinbaseexten.created.app has been taken offline, though it previously posed an elevated risk to users.

Technical analysis of coinbaseexten.created.app reveals it was flagged by 4 of 95 security vendors on VirusTotal, including alphaMountain.ai, ESET, and SOCRadar. The domain was registered through Tucows Domains Inc. on July 12, 2023, and resolved to the IP address 216.150.1.129, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. It appeared on one security blocklist, PhishDestroy, and used an SSL certificate issued by Let's Encrypt (R13). The observed page title was '404: This page could not be found,' and the site returned an HTTP 404 status. Nameservers for the domain were ns1.vercel-dns.com and ns2.vercel-dns.com.

Users who may have interacted with coinbaseexten.created.app should immediately change their Coinbase passwords and enable two-factor authentication (2FA) if they have not already done so. Monitor accounts for unauthorized transactions or suspicious activity, and report any fraud to Coinbase support. Additionally, victims can report the phishing domain to Google Safe Browsing, the Anti-Phishing Working Group (APWG), or their local cybercrime authority to aid in takedown efforts.