coin-base-loin-doc[.]daftpage[.]com

Analysis of the domain coin-base-loin-doc.daftpage.com indicates an active phishing infrastructure impersonating Coinbase, targeting cryptocurrency users. The domain was registered on October 24, 2021, and remains operational as of July 12, 2026. Infrastructure analysis reveals hosting on Amazon Web Services (AS16509) with an IP resolution to 216.150.16.1, and nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, suggesting deployment via Vercel’s platform. The site employs a seed phrase phishing kit, a technique commonly used to harvest cryptocurrency wallet credentials. The page title, 'Coinbase Pro Login Guide – Fast & Protected Account Access,' aligns with brand impersonation tactics, though the exact content and functionality of the site have not been directly analyzed. Technologies detected include Node.js, React, Next.js, and HSTS, alongside Google Analytics and Crisp Live Chat, which may be used for tracking or social engineering. The domain is flagged by Google Safe Browsing for social engineering and appears on one security blocklist. Twelve of 95 security vendors on VirusTotal have flagged the domain, though this does not constitute conclusive evidence of malicious activity. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and association with seed phrase phishing. Network-level blocking is recommended, along with monitoring for credential submissions or wallet interactions. The SSL certificate, issued by Let’s Encrypt (R13), does not mitigate the threat, as phishing sites routinely use valid certificates. Further investigation into the kit’s backend infrastructure may reveal additional indicators of compromise.