pro-coinbase-web-us[.]daftpage[.]com

This domain, pro-coinbase-web-us.daftpage.com, is identified as a high-risk brand impersonation threat targeting Coinbase users. The page mimics the legitimate Coinbase login interface, presenting a title of 'Coinbase - Buy and Sell Bitcoin, Ethereum' to deceive victims into entering credentials or sensitive financial information. No direct evidence of a crypto drainer kit was observed, but the domain's structure and content align with credential harvesting tactics commonly used in cryptocurrency-related phishing campaigns. Analysis indicates the domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.16.193, hosted on Amazon.com, Inc. infrastructure (AS16509). VirusTotal reports 21 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly marks it as phishing. The domain appears on two security blocklists, and its SSL certificate is issued by Let's Encrypt (R13). These technical indicators confirm the domain's involvement in malicious activity. As of the latest intelligence, pro-coinbase-web-us.daftpage.com has been taken offline, and it is blocked by multiple threat intelligence platforms. However, the infrastructure remains a residual risk, as threat actors may repurpose the domain or associated IP addresses for future campaigns. Organizations and users are advised to monitor for similar impersonation attempts, particularly those leveraging subdomains of legitimate services like daftpage.com. Blocking the domain and its resolving IP at the network level is recommended to prevent potential re-emergence.