acccess-cnbase-proauth[.]daftpage[.]com

Analysis indicates that acccess-cnbase-proauth.daftpage.com remains active as of July 12 2026 with a recorded creation date of October 24 2021 through OVH SAS. The domain resolves to IP address 216.150.1.193 and carries an SSL certificate issued by Let's Encrypt. Infrastructure analysis reveals deployment of Node.js React Next.js Vercel HSTS Google Analytics and Crisp Live Chat. The site is blocked by PhishDestroy and appears on one security blocklist while carrying a Gridinsoft trust score of 0 out of 100. VirusTotal reports detections from 9 out of 95 vendors. The threat type is classified as brand impersonation targeting Coinbase with the observed page title matching Coinbase ® | Sign In to Your Account ®.

The combination of high risk level active status and explicit brand targeting confirms the domain functions as an impersonation resource. Registration details and IP resolution provide concrete attribution points for network defenders. Technology stack evidence shows modern web frameworks consistent with dynamic content delivery yet no additional ASN or geolocation data is supplied in available records. The single blocklist appearance and moderate VirusTotal score leave room for variation in detection coverage across vendors.

What remains uncertain is the precise duration of current hosting uptime and any changes to backend configuration since the last blocklist update. Exact content served at the time of analysis is not documented beyond the page title. Defenders should block the IP 216.150.1.193 at network perimeters and add the full domain to internal blocklists. Continuous monitoring of DNS resolution and certificate transparency logs is advised to detect any rehosting. Incident response teams can reference the October 2021 creation date and OVH SAS registration when correlating with historical logs.