access-secure-coin-pro[.]daftpage[.]com

The domain access-secure-coin-pro.daftpage.com is currently active and presents the page title “Coinbase - Sign in”. The site explicitly impersonates the cryptocurrency exchange Coinbase, aligning with the reported brand target. The registration date of October 24 2021, through OVH SAS, and the use of Vercel DNS nameservers indicate a relatively mature but still exploitable lifecycle. Network analysis shows the domain resolves to the IP address 216.150.1.129, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting environment runs Node.js with a stack that includes React, Next.js, and Vercel, while also loading external services such as YouTube, Google Analytics, and Crisp Live Chat. The site serves an HTTPS certificate issued by Let’s Encrypt (R13) and reports HTTP status code 308, suggesting a permanent redirect is in place. Reputation services give the domain extremely low scores: Gridinsoft rates it 0/100, Scamadviser 1/100, and the site appears on two public blocklists, including PhishDestroy and PhishingDB. VirusTotal has flagged the domain in 14 of 95 scanned security vendors, reinforcing the malicious classification. The combination of a high‑risk brand impersonation, a low trust score, and active blocklist entries confirms the site’s malicious intent. Defenders should block the domain at network perimeter and endpoint controls, and add the associated IP 216.150.1.129 to deny lists. Monitoring for DNS queries to ns1.vercel-dns.com and ns2.vercel-dns.com that resolve to this IP can provide early warning of similar deployments. Organizations that rely on Coinbase credentials should educate users about the illegitimate “Coinbase - Sign in” page title and enforce multi‑factor authentication to mitigate credential harvesting.