investing-secure-coinbase[.]daftpage[.]com

The domain investing-secure-coinbase.daftpage.com is a high-risk brand impersonation attack targeting the digital asset exchange Coinbase. No drainer kit was identified, but the domain was designed to trick users into providing sensitive information, such as login credentials or financial details.

Analysis indicates that the domain has a VirusTotal score of 17/95, with 17 security vendors flagging it as malicious. The domain was registered through OVH, SAS, and is associated with an IP address 216.150.16.65, which is located in the United States and belongs to AS16509 Amazon.com, Inc. The domain was created on October 24, 2021, and Google Safe Browsing has marked it as a phishing site. It appears on 2 security blocklists, including PhishDestroy and PhishingDB.

The domain is currently offline, and it has been taken down. However, users should remain vigilant as the domain could potentially be re-registered or reused in future attacks. Response actions have included blocking the domain on various security platforms. Despite these measures, there remains a risk that users who visited the site before it was taken down may have already fallen victim to the impersonation attempt. Security teams are advised to monitor for any related activity and educate users about the dangers of visiting untrusted or unfamiliar domains that purport to be associated with legitimate financial services.