coinbase-cdn-help[.]daftpage[.]com

The domain coinbase-cdn-help.daftpage.com was registered on October 24, 2021 via OVR, SAS and currently resolves to the Amazon‑owned IP 216.150.1.1 (AS16509). Infrastructure analysis shows the site is hosted on Vercel DNS (ns1.vercel-dns.com, ns2.vercel-dns.com) and serves content over HTTPS with a Let’s Encrypt R13 certificate. HTTP responses return a 308 permanent redirect, and the page title observed is "Coinbase Pro Login | Secure Access to Your Account," indicating a direct brand impersonation of Coinbase. Detected technologies include Node.js, React, Next.js, HSTS, Google Analytics, Crisp Live Chat, and embedded YouTube assets, suggesting a modern web stack typical of fraudulent credential‑harvesting sites. Google Safe Browsing classifies the domain under the SOCIAL_ENGINEERING category, and PhishDestroy has already blocked it; it appears on one external blocklist. The Gridinsoft trust score is 0/100, and 11 of 95 VirusTotal scanners flag the domain, reinforcing the malicious assessment. The site is labeled as a crypto‑related scam. While the exact page content has not been inspected, the combination of brand‑specific title, hostile hosting configuration, and multiple security detections provides strong evidence of an active impersonation campaign. Defenders should add the domain to DNS and URL filtering policies, monitor outbound connections to the associated IP, and enforce multi‑factor authentication for any Coinbase‑related services. Continuous threat‑intel feeds should be consulted for any updates, and incident response teams should treat any credential submissions to this domain as compromised.