prime-secure-log-base[.]daftpage[.]com

This domain, prime-secure-log-base.daftpage.com, poses a high-risk brand impersonation threat specifically targeting Coinbase users. The site mimics the Coinbase Pro login interface, using the page title 'Coinbase Pro Login — How to Access' to deceive victims into entering credentials. Analysis indicates the domain is designed for credential theft, likely to gain unauthorized access to cryptocurrency exchange accounts, enabling subsequent unauthorized transactions or account takeovers.

Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.1.1, hosted on Amazon.com, Inc. (AS16509). It is flagged by 19 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt (R13), a common choice for malicious actors due to its low barrier to entry.

Users who visited prime-secure-log-base.daftpage.com should immediately revoke any entered credentials, particularly those associated with Coinbase or other cryptocurrency platforms. Enable multi-factor authentication (MFA) on all financial and cryptocurrency accounts to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the respective platform's security team. If credentials were reused across multiple services, update passwords on all affected accounts to prevent further compromise.