us-coinbase-extensionn[.]daftpage[.]com

The domain us-coinbase-extensionn.daftpage.com is currently active and resolves to IP 216.150.1.193, which is assigned to AS16509 Amazon.com, Inc. in the United States. Registration records indicate creation on 24 October 2021 via the OVH registrar. The site presents an HTTPS certificate issued by a public certificate authority and returns HTTP status 308, indicating a permanent redirect. DNS resolution uses name servers ns1.vercel-dns.com and ns2.vercel-dns.com. Fingerprinting shows a web stack built on Node.js with React and Next.js, hosted on a platform that provides HSTS and includes embedded YouTube content and a live‑chat widget. The page title reported is “Coinbase Extension Security Features,” and the domain is explicitly marked as impersonating the Coinbase brand in a crypto‑scam scenario. A Gridinsoft trust score of 0 / 100 and detections from 11 of 95 security vendors on VirusTotal further reinforce the malicious assessment. The domain appears on at least one blocklist, including PhishDestroy. Given the high‑risk brand‑impersonation label, active status, low trust score, and multiple vendor detections, the domain should be considered hostile. Defensive actions should include adding the domain to DNS blocklists, denying HTTP/HTTPS traffic to the associated IP at network perimeters, and monitoring for any outbound connections to the host. Further packet capture and sandbox analysis are advised to determine if credential‑stealing or cryptocurrency‑draining functionality is present.