public-coinbasehlep-cdn[.]daftpage[.]com

This domain, public-coinbasehlep-cdn.daftpage.com, is actively impersonating Coinbase Pro, as indicated by its page title ('Official Site® | Coinbase Pro | Digital Asset Exchang') and confirmed brand target (Coinbase). Registered on October 24, 2021, through OVH, SAS, the domain remains operational with an HTTP 308 redirect status. Infrastructure analysis reveals it resolves to IP 216.150.16.129 (AS16509, Amazon.com, Inc., US) and uses nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, suggesting deployment on Vercel's platform. Detected technologies include Node.js, React, Next.js, and Google Analytics, alongside Crisp Live Chat, which may be leveraged for real-time interaction with victims. The domain is flagged by Google Safe Browsing for social engineering and appears on at least one security blocklist, with 13 of 95 security vendors on VirusTotal identifying it as malicious. The scam type is classified as a crypto scam, aligning with the impersonated brand's services. Defenders should note the use of a Let's Encrypt SSL certificate (R13), which provides HTTPS encryption but does not validate legitimacy. The domain's age (nearly five years) and persistent activity indicate a long-term campaign, though specific tactics beyond brand impersonation remain unconfirmed. Immediate takedown requests should target the hosting provider (Vercel) and registrar (OVH), with monitoring for shifts in IP or nameserver infrastructure to evade mitigation.