access-coin-coms[.]daftpage[.]com

The domain access-coin-coms.daftpage.com poses a significant brand impersonation threat, specifically targeting Coinbase users by mimicking the legitimate website. The page title reads 'Coinbase Sign In,' which is a direct attempt to deceive users into believing they are interacting with a legitimate Coinbase platform. This kind of impersonation increases the risk of unauthorized access to sensitive user information such as login credentials.

Analysis reveals that 18 out of 95 security vendors on VirusTotal have flagged access-coin-coms.daftpage.com as malicious. The domain was registered through OVH, SAS on October 24, 2021, and has since been taken offline. It resolves to IP address 216.150.1.129, located in the US under AS16509 owned by Amazon.com, Inc. Furthermore, this domain is listed on two security blocklists and is explicitly flagged for phishing by Google Safe Browsing. Its SSL certificate is issued by Let's Encrypt, which occasionally serves as a low-cost option for malicious actors to appear credible.

If users have interacted with this domain, they should immediately change their Coinbase account passwords and enable two-factor authentication for added security. Monitoring account activity for any unauthorized transactions is advisable. Additionally, users should consider informing Coinbase support to raise awareness about potential fraudulent activities. As a preventive measure, users are encouraged to use reliable security tools that can detect and block access to known malicious domains.