coinbse-pro-lgn[.]daftpage[.]com

This domain, coinbse-pro-lgn.daftpage.com, is actively flagged as a high-risk phishing site targeting Coinbase users. Analysis indicates the page title explicitly impersonates Coinbase Pro, displaying 'Coinbase Pro Login | Secure Access to Your Crypto Account' to deceive victims into entering credentials. The domain resolves to 216.150.16.193, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. While the domain was registered on October 24, 2021, through OVH, SAS, its recent malicious activity suggests compromise or repurposing for fraudulent operations. Infrastructure analysis reveals the use of Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and technologies including Node.js, React, Next.js, and HSTS, which are consistent with modern web applications but also commonly exploited for phishing. The presence of Google Analytics and Crisp Live Chat suggests an attempt to mimic legitimate service interactions, though these tools are often abused to enhance credibility. A 308 HTTP status indicates a permanent redirect, which may be used to funnel victims to a secondary malicious endpoint not yet identified. Security vendors have detected this domain with 11 out of 95 flags on VirusTotal, and it appears on at least one blocklist. Google Safe Browsing has classified the site as engaging in social engineering, reinforcing its malicious intent. The domain is currently active, and defenders should treat it as part of a cryptocurrency-focused phishing campaign. Organizations are advised to block the domain and its resolving IP at the network level, monitor for credential submissions tied to this infrastructure, and alert users who may have interacted with it. Further investigation into associated domains or IPs may uncover additional components of this campaign.