learn-en-basse[.]daftpage[.]com

This domain, learn-en-basse.daftpage.com, is actively impersonating Coinbase as part of a crypto scam operation. Registered on October 24, 2021, through OVH, SAS, it resolves to IP 216.150.16.65 (AS16509, Amazon.com, Inc., US) and uses nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. The page title explicitly mimics Coinbase's login portal ('Log In | Coinbase.com - sign in to your Account'), and the domain is classified as a crypto scam in available threat intelligence. It is flagged by Google Safe Browsing for social engineering and blocked by two security blocklists (PhishDestroy, PhishingDB). The domain has a Gridinsoft trust score of 0/100 and is detected by 14 of 95 security vendors on VirusTotal. Infrastructure analysis reveals the use of Node.js, Vercel, React, Next.js, and HSTS, alongside Google Analytics and Crisp Live Chat, suggesting a structured phishing kit. The SSL certificate is issued by Let's Encrypt (R13), and the site returns an HTTP 308 status. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS, IP, and URL levels, as well as monitoring for related IOCs in logs. The exact content of the phishing page remains unanalyzed, but the combination of branding, scam classification, and detection metrics confirms malicious intent.