coin-base-app[.]daftpage[.]com

Analysis indicates that coin-base-app.daftpage.com is an active phishing domain impersonating Coinbase, a cryptocurrency exchange platform. The domain was registered on October 24, 2021, and currently resolves to IP address 216.150.1.193, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The site employs a 'Seed Phrase Phishing' kit, a common tactic used to harvest cryptocurrency wallet recovery phrases, aligning with the reported 'Crypto Scam' classification. Infrastructure analysis reveals the use of Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and technologies including Node.js, React, Next.js, and HSTS, which may provide a veneer of legitimacy. The domain presents a page title of '💎 Coinbase Login | Securely Access Your Crypto Wallet & Exchange Account,' explicitly targeting Coinbase users. A 308 HTTP redirect status is observed, which may be used to obscure the final phishing destination or manipulate user navigation. Security vendor data shows the domain is flagged by 7 of 95 engines on VirusTotal and appears on at least one blocklist. The Gridinsoft trust score of 0/100 further supports its classification as malicious. The SSL certificate is issued by Let's Encrypt, a common but not inherently trustworthy certificate authority often exploited in phishing operations. Defenders should treat this domain as high-risk. Recommended actions include blocking the domain and its resolving IP at the network level, alerting users to the presence of this phishing attempt, and monitoring for related infrastructure (e.g., subdomains, linked domains) that may emerge. The domain remains active as of July 12, 2026, and no evidence suggests it has been taken down or remediated.