ext-coinbase-public-en[.]daftpage[.]com

ext-coinbase-public-en.daftpage.com was first registered on October 24, 2021 through OVH SAS. The domain is currently active and is classified as a high‑risk brand‑impersonation campaign targeting Coinbase users. It resolves to the IPv4 address 216.150.16.193, which belongs to Amazon.com, Inc. (AS16509) and is hosted in the United States. The web server returns an HTTP 308 permanent redirect response and presents a TLS certificate issued by Let’s Encrypt (R13). DNS resolution is delegated to ns1.vercel-dns.com and ns2.vercel-dns.com, indicating deployment on the Vercel platform. Detected front‑end components include Node.js, React, Next.js, and YouTube embeds, while Google Analytics and Crisp Live Chat scripts are also present. Reputation checks show the domain is listed on two public blocklists, PhishDestroy and PhishingDB, and Google Safe Browsing flags it for SOCIAL_ENGINEERING. VirusTotal scans returned 16 positive detections out of 95 vendors. Independent trust services assign a Scamadviser score of 1/100 and a Gridinsoft score of 0/100, reinforcing the malicious classification. The page title observed is “Getting Started: Wallet Extension,” and the campaign is labeled as a cryptocurrency‑related scam. Defenders should block both the domain and its resolving IP at perimeter filters and update endpoint URL filtering rules to include the full hostname. Continuous monitoring of Vercel‑hosted assets is advised, as the same nameserver configuration may be reused for other malicious sites. User awareness training should emphasize that legitimate Coinbase communications never originate from daftpage.com subdomains, and any unsolicited wallet‑extension prompts should be reported.