coinbsd-web-auth[.]daftpage[.]com

The domain coinbsd-web-auth.daftpage.com was identified as a brand impersonation threat specifically targeting Coinbase users. This phishing domain is currently offline, but its active campaign aimed to steal login credentials by mimicking the Coinbase Pro authentication interface. The page title, 'Log In | Coinbase Pro | Sign In to Your Account,' was designed to deceive users into entering sensitive information.

Technical analysis reveals several red flags. VirusTotal data shows that 18 out of 95 security vendors flagged this domain as malicious, and Google Safe Browsing specifically categorizes it as phishing. The domain was registered on October 24, 2021, through OVH, SAS, and its SSL certificate was issued by Let's Encrypt / R13. It resolves to IP address 216.150.1.193 and appears on two security blocklists. These indicators collectively confirm the site's malicious intent and high risk to potential victims.

Although the domain is now offline, users should remain cautious. If you encountered this site, avoid entering any credentials and ensure your accounts are secured with strong, unique passwords and two-factor authentication. PhishDestroy recommends monitoring for unauthorized access and reporting any suspicious activity to Coinbase's security team. Always verify URLs before logging in and rely on official channels for account access.