coinbseextension[.]vercel[.]app

The domain coinbseextension.vercel.app is currently active and engaged in brand impersonation targeting users of the 1inch decentralized exchange platform. Analysis confirms this as a high-risk phishing infrastructure designed to mimic the Coinbase Wallet browser extension, as evidenced by the page title "Coinbase Wallet Extension – The Most Trusted Self-Custody Browser Wallet 2025." The threat specifically aims to deceive users into disclosing cryptocurrency wallet credentials or authorizing malicious transactions under the guise of a legitimate service. Infrastructure analysis reveals the domain was registered through Vercel Inc. on March 03, 2026, and resolves to the IP address 64.29.17.67, located in the United States under AS16509 (Amazon.com, Inc.). The SSL certificate is issued by Google Trust Services (WR1), a common feature in phishing campaigns to appear legitimate. Security telemetry indicates the domain is flagged by 1 of 95 vendors on VirusTotal and appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL. The discrepancy between the domain registration date (2026) and current year suggests either a typo-squatting attempt or an error in the registration process, further indicating malicious intent. Current status remains active, posing an ongoing risk to users of 1inch and other decentralized finance platforms. Organizations and individuals are advised to block the domain and associated IP address (64.29.17.67) at the network perimeter. Users should verify the authenticity of wallet extensions by cross-referencing official sources and avoid interacting with domains hosted on content delivery networks unless explicitly linked from verified provider documentation. Cryptocurrency wallet providers are encouraged to monitor for similar impersonation attempts and implement proactive detection mechanisms for domains mimicking their branding.