auth-eng-coinbase-cdn[.]daftpage[.]com

The domain auth-eng-coinbase-cdn.daftpage.com has been identified as a high-risk threat due to brand impersonation, specifically targeting the Coinbase platform. It hosted a fraudulent login page designed to deceive users into providing sensitive authentication details, hence classified under the category of fake login threats. Coinbase's brand was used in this setup to give the impression of a legitimate user interface, leveraging trust to exploit unsuspecting victims.

Technical analysis reveals several key indicators marking this domain as a phishing threat. It was created on October 24, 2021, and is registered through OVH, SAS. VirusTotal detection is significant, with 11 out of 95 security vendors identifying the domain as malicious. The domain resolved to the IP address 216.150.1.129, located in the United States under the Amazon.com, Inc. infrastructure (AS16509). The SSL certificate was issued by Let's Encrypt, which, while generally reputable, does not preclude the domain from being used for phishing activities. Its presence on one major security blocklist further corroborates the threat level. Additionally, Google Safe Browsing has flagged the domain for phishing, supporting the notion of malicious intent.

The domain is currently offline, having been taken down following detection by PhishDestroy, which blocked access due to the impersonation risk posed. Despite its offline status, the domain's historical record of phishing activity suggests ongoing vigilance is needed, as similar domains could emerge using the same infrastructure. Preventative measures include monitoring similar domain patterns and rapid reporting of suspicious activities to ensure prompt takedown actions. Users are advised to continually verify the authenticity of login pages and remain alert to unusual domain names that deviate from the official brand URLs.