app-coinbase-pro-us[.]daftpage[.]com

This domain, app-coinbase-pro-us.daftpage.com, is flagged as an active high-risk phishing infrastructure impersonating Coinbase, a digital asset exchange. Registered on October 24, 2021, through OVH, SAS, the domain resolves to IP address 216.150.16.1 and remains operational as of July 12, 2026. Analysis indicates the presence of a seed phrase phishing kit, a common tactic used to harvest cryptocurrency wallet credentials. The page title, 'Coinbase Pro | Digital Asset Exchange®,' directly mirrors legitimate Coinbase branding, reinforcing its deceptive intent. Infrastructure analysis reveals the use of Let's Encrypt SSL certificates, Node.js, React, Next.js, and Vercel, technologies frequently employed in both legitimate and malicious web applications. The domain has been detected by 7 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. Additional technologies, including Google Analytics and Crisp Live Chat, suggest an attempt to mimic professional customer engagement practices, though their presence alone does not confirm legitimacy. What remains uncertain is the exact scale of victim interaction, as no specific metrics on traffic or successful credential harvesting are available. The domain’s longevity—active for nearly five years—may indicate persistent use in phishing campaigns, though it could also reflect periodic reactivation. Defenders should treat this domain as confirmed malicious infrastructure. Network-level blocking of the domain and its resolving IP (216.150.16.1) is recommended, along with monitoring for related subdomains or newly registered lookalike domains. End-user education should emphasize verifying URLs and avoiding seed phrase entry on untrusted sites, particularly those impersonating cryptocurrency platforms.