help-coinbasehelps-us[.]daftpage[.]com

Domain help-coinbasehelps-us.daftpage.com is identified as a high-risk brand impersonation asset targeting Coinbase. The infrastructure is designed to mimic legitimate cryptocurrency exchange interfaces, presenting a fabricated login environment intended for credential theft. Analysis confirms use of Coinbase branding and a deceptive page title mimicking exchange services, consistent with credential harvesting campaigns.

Technical indicators show VirusTotal detection ratio of 17/95 security vendors flagging malicious behavior. The domain was registered through OVH, SAS and resolves to IP 216.150.16.193, hosted under AS16509 Amazon.com, Inc. infrastructure in the United States. The SSL certificate is issued by Let's Encrypt (R13). The domain was created on October 24, 2021. Google Safe Browsing classifies it as phishing. It appears on 2 security blocklists and is referenced across multiple threat intelligence feeds.

Current status indicates the domain has been taken offline following enforcement action, reducing immediate user exposure. However, historical persistence and reuse of similar subdomain structures suggest continued risk of clone deployments or reactivation under alternate endpoints. Users who interacted with the domain should assume credential compromise and rotate affected passwords immediately. Recommended response actions include session invalidation, multi-factor authentication enforcement, and continuous monitoring for unauthorized account activity.