coiinbse-wlet-ext[.]daftpage[.]com

Analysis of coiinbse-wlet-ext.daftpage.com shows the domain was registered on October 24, 2021 through OVH, SAS and uses the authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. The domain resolves to the IP address 216.150.1.193, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The site is served over HTTPS using a Let’s Encrypt certificate (R13) and returns an HTTP 308 redirect, with HSTS enabled. Technologically the stack includes Node.js, React, Next.js, Vercel hosting, Google Analytics and Crisp Live Chat, indicating a modern web application framework.

The page title presented by the host is “Coinbase Wallet Extension for Chrome & Brave – Secure Crypto Wallet”, directly referencing the Coinbase brand. The threat type is classified as brand_impersonation with a high risk rating. Google Safe Browsing has flagged the URL for “SOCIAL_ENGINEERING”, and the domain appears on one security blocklist (PhishDestroy). The Gridinsoft trust score is 0 out of 100, and VirusTotal records seven of ninety‑five security vendors marking the domain as malicious. The site is identified as a cryptocurrency‑related scam.

Evidence points to a deliberate attempt to lure Coinbase users by mimicking a wallet extension. However, the current analysis does not include a visual inspection of the landing page, so the exact user‑interaction flow remains unknown. No additional indicators such as malicious payloads or credential harvesting scripts have been observed in the available data.

Defenders should add the domain to network and endpoint blocklists, enforce DNS filtering for the A record 216.150.1.193, and monitor for any outbound connections to the identified IP. User education campaigns should highlight the risk of unsolicited wallet extension prompts referencing Coinbase. Continuous re‑evaluation is advised, as the site remains active and may evolve its tactics.