us-coinbase-wallt-extension[.]daftpage[.]com

The domain us-coinbase-wallt-extension.daftpage.com has been assessed as an elevated risk phishing threat that specifically impersonates the Coinbase brand. This is not a simple fake login page—it functions as a crypto drainer, designed to trick users into connecting their cryptocurrency wallets under the guise of installing a legitimate Coinbase Wallet extension, ultimately stealing funds. The site was taken offline after detection, but its infrastructure and history indicate a sophisticated attempt to defraud users.

According to intelligence gathered by PhishDestroy, this domain was created on October 24, 2021, and registered through OVH, SAS. It resolves to IP address 216.150.1.129 and uses an SSL certificate from Let's Encrypt (R13), which is common among phishing sites. Alarmingly, VirusTotal reports that 15 out of 95 security vendors flag this domain as malicious, and it appears on at least one security blocklist. The page title was "Coinbase Wallet Extension for Chrome," further confirming the impersonation. These data points collectively underscore a high-confidence threat with multiple red flags.

Users who may have encountered this site should take immediate action. Since the threat is a crypto drainer, anyone who connected their wallet should consider it compromised and transfer funds to a new, secure wallet. Never download browser extensions from third-party sites; always use official stores like the Chrome Web Store. To verify any Coinbase-related communication or download, always visit the official Coinbase website directly. PhishDestroy provides a free verification service for suspicious domain names and offers guidance on reporting such threats to relevant authorities.