en-coinbasehelp-learn[.]daftpage[.]com

The domain en-coinbasehelp-learn.daftpage.com is flagged as a high-risk brand impersonation threat, specifically targeting Coinbase. Analysis indicates that the domain mimics the official Coinbase sign-in page, with the page title 'Coinbase.com Sign In | Official Site | Coinbase Help' leading users to believe they are interacting with a legitimate Coinbase service. The domain has a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100, both of which reflect a very low level of trust and a high likelihood of malicious intent. Additionally, the domain is flagged by Google Safe Browsing for social engineering, further confirming its malicious nature. Registered through OVH, SAS, the domain has been active since October 24, 2021, and currently resolves to an IP address in the United States (216.150.16.1, AS16509 Amazon.com, Inc.). The SSL certificate is issued by Let's Encrypt, which is a common choice for phishing sites to gain user trust by displaying a secure connection. The domain is also present on one security blocklist and is blocked by PhishDestroy, indicating that it has been identified and flagged by multiple security mechanisms. The exact content of the site is not yet analyzed, but the combination of the page title, trust scores, and security flags strongly suggests that it is a cryptocurrency-related scam designed to deceive users into providing sensitive information, such as login credentials or personal data. Defenders should implement DNS-level blocking, educate users about the risks of interacting with unknown or suspicious domains, and monitor network traffic for any signs of data exfiltration or unauthorized access attempts. Regularly updating security configurations and using real-time threat intelligence feeds can help mitigate the risk posed by this and similar domains.