public-coinbasehelp-cdn[.]daftpage[.]com

This domain public-coinbasehelp-cdn.daftpage.com is assessed as a brand impersonation phishing infrastructure targeting Coinbase users. The page is designed to mimic a legitimate Coinbase sign-in interface, as indicated by the page title "Sign In | Coinbase.com", with the objective of harvesting authentication credentials and potentially enabling account takeover. The infrastructure leverages deceptive branding cues and CDN-like naming to increase perceived legitimacy.

Technical evidence confirms malicious classification. VirusTotal reports 18/95 security vendors detecting the domain as malicious. The domain was registered through OVH, SAS on October 24, 2021. It resolves to IP 216.150.16.1 hosted under AS16509 Amazon.com, Inc. The domain appears on 2 security blocklists and is additionally blocked by PhishDestroy and PhishingDB. Google Safe Browsing explicitly flags the domain as phishing, reinforcing multi-source consensus of malicious intent.

Users who accessed or submitted credentials on this domain should assume compromise risk. Immediate password resets for Coinbase accounts and any reused credentials are required, along with revocation of active sessions where supported. Multi-factor authentication should be enabled or revalidated to prevent unauthorized access. Endpoint and email monitoring should be reviewed for secondary compromise attempts such as credential reuse attacks or follow-up phishing. Although the current status is taken offline, historical infrastructure indicates high likelihood of reuse in similar impersonation campaigns, and associated indicators should remain blocked in defensive systems.