nav-coinbasecn-web[.]daftpage[.]com

The domain nav-coinbasecn-web.daftpage.com has been identified as a brand impersonation threat targeting Coinbase. This domain is designed to deceive users by mimicking the appearance and functionality of legitimate Coinbase services, particularly the Coinbase Pro platform. The threat level is elevated due to the potential for credential theft and financial loss.

Analysis indicates that the domain has a VirusTotal score of 18/95, suggesting that a significant number of security vendors flag it as malicious. The domain was registered through OVH, SAS on October 24, 2021, and resolves to the IP address 216.150.16.65, located in the US and associated with Amazon.com, Inc. (AS16509). The SSL certificate is issued by Let's Encrypt / R13, which is common for both legitimate and malicious sites. The domain currently appears on two security blocklists, PhishDestroy and PhishingDB, and is listed in Google Safe Browsing as potentially unsafe.

The domain is currently offline, which reduces the immediate risk to users. However, the infrastructure and registration details suggest a sophisticated and potentially ongoing campaign. It is recommended that affected users change their Coinbase passwords and enable two-factor authentication. Security teams should monitor for similar domains and IP addresses to prevent further impersonation attempts. The remaining risk is mitigated but not eliminated, and continued vigilance is advised.