help-coinbase-pro-en[.]daftpage[.]com

This domain, help-coinbase-pro-en.daftpage.com, is identified as a high-risk brand impersonation threat specifically targeting Coinbase Pro users. Analysis indicates the site mimics the official Coinbase Pro login interface, as evidenced by its page title, 'Log-in | Coinbase Pro | Digital Asset®,' designed to deceive users into submitting sensitive credentials. The domain is currently offline, but prior activity confirms its malicious intent. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.1.193, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendors have flagged this domain extensively, with 18 out of 95 VirusTotal vendors marking it as malicious. Additionally, it appears on two security blocklists, including PhishDestroy and PhishingDB, and was previously flagged by Google Safe Browsing as a phishing site. The SSL certificate, issued by Let's Encrypt (R13), does not mitigate the risk, as phishing domains commonly use valid certificates to appear legitimate. The current offline status of help-coinbase-pro-en.daftpage.com does not eliminate the risk, as threat actors may reactivate similar domains or shift infrastructure. Users and organizations are advised to implement proactive measures, including blocking the domain and its associated IP address (216.150.1.193) at the network level. Security teams should monitor for related domains registered through the same registrar (OVH, SAS) or resolving to the same IP range. End-users should verify the authenticity of login pages by checking the URL and SSL certificate details before entering credentials. If exposure is suspected, immediate password resets and multi-factor authentication reviews are recommended to mitigate potential account compromise.