coinbase-extension-io[.]meku[.]app

This domain, coinbase-extension-io.meku.app, is identified as a high-risk brand impersonation threat targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site mimics the Coinbase Wallet interface, presenting a page titled 'Coinbase Extension® — Getting Started | Coinbase Wallet®' to deceive users into entering credentials or installing malicious browser extensions. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and branding align with known credential harvesting tactics used in cryptocurrency phishing campaigns. Technical indicators confirm the domain’s malicious intent. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious. The domain was registered on February 21, 2026, through Porkbun LLC, and resolves to the IP address 157.230.64.11, hosted on AS14061 (DigitalOcean, LLC) in the United States. It appears on three security blocklists, and the SSL certificate is issued by Let’s Encrypt (serial number E7). No Google Safe Browsing (GSB) listing was recorded at the time of analysis, but the domain was actively blocked by multiple independent security feeds. The domain is currently offline, likely due to takedown efforts or infrastructure changes. However, the registration remains active, posing a residual risk of reemergence under the same or similar infrastructure. Users who interacted with the domain should assume credential compromise and revoke any associated browser extensions or wallet permissions. Organizations are advised to monitor for related domains registered through Porkbun LLC or resolving to the same IP range, as threat actors frequently reuse hosting providers and IP blocks for phishing campaigns.