explore-coinbase-pro[.]daftpage[.]com

The domain explore-coinbase-pro.daftpage.com is currently active and presents a page titled “Log‑in | Coinbase Pro | Digital Asset®”, directly referencing the Coinbase brand. The site is classified as a high‑risk brand‑impersonation campaign targeting Coinbase users, with the intent to harvest credentials or otherwise exploit the cryptocurrency brand. Technical analysis shows the domain resolves to 216.150.1.1, an IP address owned by Amazon.com, Inc. (AS16509) located in the United States. DNS resolution is handled by ns1.vercel‑dns.com and ns2.vercel‑dns.com, indicating deployment on the Vercel platform. The web server presents a Let’s Encrypt R13 certificate and issues an HTTP 308 permanent redirect, while supporting HSTS. Detected front‑end components include Node.js, React, Next.js, YouTube embeds, Google Analytics, and Crisp Live Chat, suggesting a modern JavaScript stack. Threat intelligence flags this domain on a single public blocklist (PhishDestroy) and records eight detections out of ninety‑five scanners on VirusTotal. Google Safe Browsing lists the domain under the SOCIAL_ENGINEERING category. A Gridinsoft trust score of 0 / 100 further reinforces the malicious assessment. The domain was registered on 24 Oct 2021 through OVH SAS, but no additional hosting changes have been observed since registration. Defenders should immediately block resolve‑to‑IP 216.150.1.1 and the fully qualified domain name in perimeter firewalls, DNS filtering, and secure web gateways. Continuous monitoring of Vercel‑hosted assets and rapid updating of intrusion‑detection signatures are advised, given the use of a widely available web‑app framework. End‑user education should emphasize verification of the authentic Coinbase URL and caution against unsolicited login prompts that reference Coinbase Pro.