secure-coinbase-t-auth[.]daftpage[.]com

The domain secure-coinbase-t-auth.daftpage.com is currently active and has been classified as a high‑risk brand‑impersonation site targeting Coinbase users. The page title returned by the server is "Log-in | Coinbase Pro | Digital Asset Exchange®", matching the advertised brand target. Infrastructure analysis shows the domain resolves to IP 216.150.1.193, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The domain was registered on October 24, 2021 through OVH SAS and uses a Let's Encrypt R13 certificate, with HTTP responses indicating a permanent redirect (308). DNS resolution is provided by ns1.vercel-dns.com and ns2.vercel-dns.com, consistent with a Vercel hosting environment. Detected web technologies include Node.js, React, Next.js, Vercel, HSTS, Google Analytics, and Crisp Live Chat, suggesting a modern JavaScript stack. Reputation data shows a Gridinsoft trust score of 0/100 and Google Safe Browsing flags the site for SOCIAL_ENGINEERING. The domain appears on two public blocklists and is listed by PhishDestroy and PhishingDB. VirusTotal analysis reports 14 of 95 security vendors flagging the domain, reinforcing the malicious assessment. While the exact phishing page content has not been examined, the convergence of brand‑matching title, malicious reputation signals, and known crypto‑scam classification indicates a credible threat. Defenders should block the domain at network perimeter, monitor DNS queries for the associated nameservers, and enforce credential‑validation controls for any outbound connections to the IP address. Continuous observation is advised to detect any changes in hosting or payload delivery.