cooinbase-extenton-portal[.]daftpage[.]com

The domain cooinbase-extenton-portal.daftpage.com was registered on October 24, 2021 through OVR, SAS and is hosted on a Vercel infrastructure that resolves to IP address 216.150.16.193. The certificate is a Let’s Encrypt R13 certificate, and the site returns an HTTP 308 redirect response. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on a single security blocklist. The page title advertised by the site, "Coinbase Extension | Web3 & Crypto in Your Browser," directly references the Coinbase brand, confirming a brand‑impersonation intent aimed at cryptocurrency users.

Technical profiling shows the site runs Node.js with React and Next.js, incorporates YouTube embeds, Google Analytics trackers, and Crisp Live Chat widgets, all served behind Vercel DNS (ns1.vercel-dns.com and ns2.vercel-dns.com). HSTS is enabled, and the host resides in the United States under AS16509, an Amazon.com, Inc. network. Google Safe Browsing flags the domain for SOCIAL_ENGINEERING, and PhishDestroy has already blocked it. VirusTotal analysis shows 11 out of 95 security vendors label the domain as malicious, reinforcing the suspicion of malicious activity.

Analysis indicates that the domain is actively used for cryptocurrency‑related brand impersonation, with a high risk rating despite the modest blocklist presence. Defenders should immediately add the domain to network deny‑lists, enforce URL filtering for any references to "Coinbase" that resolve to this host, and monitor outbound connections to the associated IP range. Users should be warned that any unsolicited prompts to install a "Coinbase" browser extension from this URL are likely fraudulent, and incident response teams should treat any credential or token exposure as a potential compromise.