crome-extt-coiinbse[.]daftpage[.]com

On July 12, 2026, the domain crome-extt-coiinbse.daftpage.com was identified as an active brand impersonation threat targeting Coinbase. This domain resolves to the IP address 216.150.16.193, located in the United States and associated with AS16509 Amazon.com, Inc. The domain was created on October 24, 2021, and is currently using nameservers provided by Vercel. Infrastructure analysis reveals that the domain is leveraging technologies such as Node.js, React, Next.js, and Vercel for its operations, indicating a sophisticated setup to mimic legitimate services. The page title, 'Coinbase Chrome Extension – Secure Crypto Wallet,' suggests an attempt to deceive users into believing they are accessing a legitimate Coinbase Chrome extension. The Gridinsoft trust score of 0/100 and the flag from Google Safe Browsing for 'SOCIAL_ENGINEERING' further corroborate the malicious intent of this domain. Analysis indicates that the domain is likely involved in a crypto scam, and it is currently blocked by PhishDestroy. Defenders should be cautious and consider blocking this domain to prevent potential financial losses and data breaches. The exact content of the page has not been analyzed, but the combination of the page title and the low trust score provides strong evidence of a phishing attempt. Immediate action should be taken to inform users and monitor for any related malicious activities.