about-coinbasehelp-cdn[.]daftpage[.]com

This domain poses as a legitimate Coinbase login portal to deceive users into entering account credentials. The site mimics the official Coinbase sign-in page, potentially capturing usernames, passwords, and two-factor authentication codes. Such brand impersonation attacks often lead to unauthorized account access, financial theft, or further exploitation through compromised credentials. Users may be redirected to fake support pages or prompted to download malicious software under the guise of security verification. Analysis indicates the domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.1.193, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendors on VirusTotal flagged the domain as malicious, with 20 out of 95 engines detecting it as a threat. The site appears on two security blocklists and is confirmed to impersonate Coinbase, a well-known cryptocurrency exchange. The SSL certificate, issued by Let's Encrypt (R13), does not validate legitimacy, as attackers frequently use valid certificates to appear trustworthy. If you visited about-coinbasehelp-cdn.daftpage.com or entered credentials, immediately change your Coinbase password and enable multi-factor authentication if not already active. Review recent account activity for unauthorized transactions or logins. Check connected devices and revoke access for any unrecognized sessions. Monitor linked email accounts for suspicious password reset requests or phishing attempts. Report the incident to Coinbase support and consider notifying relevant financial authorities if funds were compromised. Avoid interacting with unsolicited links or attachments, even if they appear to originate from trusted sources.