secure-coinhelp-cdn[.]daftpage[.]com

The domain secure-coinhelp-cdn.daftpage.com is currently active and classified as a high‑risk brand‑impersonation site targeting Coinbase. The page title returned by the server is "Coinbase - Sign in", confirming the intended brand spoof. Infrastructure analysis shows the domain resolves to IP 216.150.16.65, hosted within the Amazon.com, Inc. AS16509 network in the United States. The site is served over HTTPS with a Let’s Encrypt R13 certificate and returns an HTTP 308 status code. DNS is managed by Vercel (ns1.vercel-dns.com, ns2.vercel-dns.com). Technical fingerprints reveal a stack built on Node.js, React, Next.js, and Vercel, with HSTS enabled and ancillary services such as YouTube embeds, Google Analytics, and Crisp Live Chat present. The domain was created on 24 October 2021 via OVH SAS. Reputation data indicates a Gridinsoft trust score of 0/100, Google Safe Browsing flags for SOCIAL_ENGINEERING, and 14 of 95 VirusTotal scanners flag the host. It is listed on two public blocklists (PhishDestroy, PhishingDB) and is currently marked as active. Defenders should immediately block the domain at perimeter and endpoint layers, add the associated IP and Vercel name servers to deny lists, and monitor for any new subdomains that resolve to the same IP range. Ongoing threat‑intel feeds should be consulted for any updates, and users should be warned against any unsolicited prompts to log into Coinbase from this URL. Continuous verification of DNS changes is advised, given the use of a cloud‑based DNS provider that can rapidly update records.