wlecome-coinbase-cdn-en[.]daftpage[.]com

The domain wlecome-coinbase-cdn-en.daftpage.com is a brand impersonation attack specifically targeting Coinbase users, posing as a Coinbase Pro login page. As of the latest intelligence, the domain has been taken offline, but it represents a high-risk threat due to its precise mimicry of the official Coinbase Pro interface. The page title "Coinbase pro Login* | Official Account Access" was designed to deceive users into entering their credentials, leading to account compromise and potential financial loss.

Technical indicators reveal that this domain was flagged by 16 out of 95 VirusTotal vendors as malicious, indicating broad consensus among security tools. It also appeared on two security blocklists and was flagged by Google Safe Browsing as phishing. The domain was registered through OVH, SAS, and resolved to IP address 216.150.16.65 at the time of analysis. It was created on October 24, 2021, and used a Let's Encrypt SSL certificate (R13) to appear legitimate. The risk level was rated high due to the direct targeting of a major cryptocurrency exchange.

Although the domain is now offline, users who may have visited it should immediately change their Coinbase passwords and enable two-factor authentication. It is also advisable to monitor accounts for unauthorized transactions and report any suspicious activity to Coinbase support. PhishDestroy recommends always verifying URLs before entering credentials, especially for financial services, and using browser extensions that block known phishing domains. Staying vigilant against such impersonation attempts is crucial in protecting digital assets.