coinbasextension[.]vercel[.]app

PhishDestroy identifies coinbasextension.vercel.app as an active crypto drainer posing as Coinbase, leveraging brand trust to trick users into connecting wallets or entering credentials. This Vercel-hosted domain (64.29.17.3) mirrors Coinbase’s branding to deceive cryptocurrency holders into approving malicious transactions or surrendering sensitive data. The threat is elevated due to its exploitation of legitimate infrastructure (Vercel’s hosting) combined with cryptocurrency-focused lures, which are particularly damaging in this high-stakes sector.

This domain was flagged by 11 out of 95 VirusTotal security vendors, including reputable engines like Kaspersky and ESET, indicating significant malicious intent. It resolves to Google Trust Services-validated infrastructure (64.29.17.3) but is registered through Vercel Inc., a legitimate cloud platform abused for hosting phishing content. The impersonation of Coinbase, a major crypto exchange, amplifies the risk for users seeking secure financial platforms.

If you interacted with coinbasextension.vercel.app, immediately revoke any connected wallet permissions via your wallet’s interface (e.g., MetaMask’s ‘Connected Sites’ or wallet address permissions). Do not enter credentials or connect wallets to unverified domains. Report the site to Coinbase’s abuse team and your browser’s security extensions. For future protection, use wallet address screening tools and only access crypto platforms via bookmarked official URLs.