welcome-coin-docs[.]daftpage[.]com

This domain, welcome-coin-docs.daftpage.com, is identified as a high-risk brand impersonation threat targeting Coinbase, a major cryptocurrency exchange platform. Analysis of the page title, 'Coinbase Extension: Your Crypto Gateway Explaine,' confirms the intent to deceive users into believing the site is an official Coinbase extension or service. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft and fraudulent transaction facilitation, common in cryptocurrency-related phishing schemes. Infrastructure analysis reveals the domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.1.193, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. It appears on two security blocklists, PhishDestroy and PhishingDB, and employs a Let's Encrypt SSL certificate (R13) to lend an appearance of legitimacy. The creation date suggests the domain may have been repurposed for malicious activity after an initial benign registration period. As of the latest verification, welcome-coin-docs.daftpage.com has been taken offline, likely due to detection and reporting by security vendors or hosting provider intervention. However, the underlying infrastructure remains a residual risk, as threat actors may reuse the IP address, registrar, or SSL certificate chain for future campaigns. Organizations and users are advised to block the domain and associated IP at the network level, monitor for related indicators of compromise, and educate users on identifying brand impersonation tactics in cryptocurrency contexts. Persistent vigilance is required, as similar domains may emerge leveraging the same registrar or hosting provider.