website-coin[.]daftpage[.]com

website-coin.daftpage.com is a high-risk domain that impersonates Coinbase, posing a significant threat of brand impersonation. This domain was designed to deceive users into believing they are accessing an official Coinbase login page, which could lead to the theft of sensitive information such as usernames, passwords, and financial details.

Analysis indicates that the domain was created on October 24, 2021, and is registered through OVH, SAS. The domain has been flagged by 17 out of 95 security vendors on VirusTotal, and it appears on 2 security blocklists, including PhishDestroy and PhishingDB. The domain resolves to an IP address located in the United States, specifically 216.150.16.193, which is part of the AS16509 network owned by Amazon.com, Inc. The SSL certificate is issued by Let's Encrypt, which is a common tactic used by malicious actors to gain user trust. Google Safe Browsing has also flagged this domain as phishing, further confirming its malicious intent.

Users who have visited this domain should immediately change their Coinbase login credentials and monitor their accounts for any unauthorized activity. It is recommended to report the incident to Coinbase's support team and to check for any other potential compromises, such as the installation of malicious software or the theft of additional personal information. Users should also consider running a full system scan to ensure their devices are not infected with malware.