welcome-coinbasehelp-docs[.]daftpage[.]com

Analysis of welcome-coinbasehelp-docs.daftpage.com indicates a high-risk credential-theft operation targeting Coinbase users. The domain, registered on October 24, 2021, resolves to 216.150.16.193 and is hosted through OVH, SAS. It currently displays the page title 'Coinbase - Login', directly impersonating the legitimate Coinbase login portal. The site is flagged by 15 of 95 security vendors on VirusTotal and appears on two security blocklists, including PhishDestroy and PhishingDB. Gridinsoft assigns a trust score of 0/100, further confirming its malicious classification. Infrastructure analysis reveals the use of Node.js, React, Next.js, and Vercel, alongside Google Analytics and Crisp Live Chat, suggesting a modern, interactive phishing kit designed to harvest credentials and potentially facilitate real-time interaction with victims. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing pages. The domain remains active as of July 12, 2026, with no signs of takedown or mitigation. Defenders should treat this domain as a confirmed phishing resource. Block access at the network level, flag it in endpoint protection systems, and monitor for related indicators of compromise, such as connections to 216.150.16.193 or associated infrastructure. The exact content of the phishing page beyond the title is not yet analyzed, but the presence of a Coinbase-branded login page strongly indicates credential theft as the primary objective. No evidence of additional scam categories (e.g., crypto drainers, giveaways) is present in the available data.