overview-coinbase-pro[.]daftpage[.]com

This domain, overview-coinbase-pro.daftpage.com, is actively flagged as a high-risk crypto phishing site impersonating Coinbase Pro. Registered on October 24, 2021, through OVH, SAS, the domain resolves to IP 216.150.16.65, hosted on Amazon Web Services (AS16509). Infrastructure analysis reveals the use of Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and a Let's Encrypt SSL certificate, suggesting a modern, cloud-based deployment. The page title, 'Coinbase Pro Login — How to Access,' directly aligns with the confirmed brand target, Coinbase, and the scam type classified as a crypto scam. Google Safe Browsing has flagged the domain for social engineering, and it appears on two security blocklists, including PhishDestroy and PhishingDB. Technologies detected include Node.js, React, Next.js, and Google Analytics, indicating a dynamic, interactive frontend likely designed to harvest credentials or facilitate fraudulent transactions. The domain remains active as of July 12, 2026, with a persistent HTTP 308 redirect status, which may be used to funnel victims to a secondary malicious endpoint. While 14 of 95 security vendors on VirusTotal have flagged the domain, the exact nature of the payload or backend infrastructure is not yet fully analyzed. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related services are accessed. Given the use of Vercel hosting and a valid SSL certificate, traditional reputation-based filters may not catch this threat, necessitating behavioral or heuristic detection methods. Further investigation into associated IP ranges, certificate transparency logs, and historical WHOIS data may uncover additional linked infrastructure.