secure-coiinsbase-com-en[.]daftpage[.]com

This domain, secure-coiinsbase-com-en.daftpage.com, is identified as a high-risk phishing resource impersonating the Coinbase cryptocurrency exchange platform. Analysis confirms it as a brand_impersonation threat, designed to deceive users into submitting login credentials or financial details under the guise of the legitimate Coinbase sign-in portal. The page title, 'Coinbase.com Sign-in | Buy/Sell Cryptocurrency,' closely mimics official Coinbase branding, increasing the likelihood of successful social engineering attacks against unsuspecting victims. Infrastructure analysis reveals the following technical indicators: the domain was registered on October 24, 2021, through OVH, SAS, and resolves to IP address 216.150.1.193, hosted on Amazon.com, Inc. (AS16509) infrastructure. The SSL certificate is issued by Let's Encrypt (R13), providing a false sense of security. Google Safe Browsing explicitly flags this domain as phishing, and it appears on at least one security blocklist. VirusTotal reports 11 out of 95 security vendors detecting this domain as malicious, further corroborating its fraudulent nature. As of the latest assessment, secure-coiinsbase-com-en.daftpage.com has been taken offline, reducing immediate exposure to end users. However, the domain registration remains active, and the underlying infrastructure could be repurposed for future malicious campaigns. Organizations and individuals are advised to block the domain and associated IP address at the network perimeter. Users who may have interacted with this domain should immediately reset their Coinbase credentials and enable multi-factor authentication. Continuous monitoring of related domains and IP ranges is recommended to mitigate residual risk from this threat actor.