extension-coinn-en[.]daftpage[.]com

This domain, extension-coinn-en.daftpage.com, operates as a high-risk brand impersonation site specifically targeting Coinbase users. Analysis indicates the site masquerades as the legitimate Coinbase Wallet Extension, using the page title 'Coinbase Wallet Extension – Your Secure Gateway to Web3' to deceive victims into believing they are interacting with an official crypto wallet service. The primary threat involves credential theft, where attackers harvest login details, recovery phrases, or private keys under the guise of a trusted brand, potentially leading to unauthorized access to cryptocurrency accounts and financial loss. Infrastructure analysis reveals multiple red flags supporting the malicious classification. The domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.16.129, hosted on Amazon.com, Inc.'s AS16509. Security vendors on VirusTotal flagged the domain at a rate of 13/95, while Google Safe Browsing explicitly labels it as phishing. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, providing minimal assurance of authenticity. Users who visited extension-coinn-en.daftpage.com should take immediate action to mitigate potential risks. If any credentials, recovery phrases, or private keys were entered, affected accounts must be secured by revoking access to unknown devices or sessions, enabling multi-factor authentication, and transferring assets to a new, secure wallet. Monitor linked accounts for unauthorized transactions and report suspicious activity to the legitimate service provider. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts, as threat actors frequently rotate infrastructure to evade detection.