app-en-coinbase-pro[.]daftpage[.]com

This domain, app-en-coinbase-pro.daftpage.com, is actively flagged as a high-risk phishing site impersonating Coinbase, specifically targeting cryptocurrency users through a seed-phrase phishing kit. Infrastructure analysis reveals the domain was registered on October 24, 2021, via OVH, SAS, and currently resolves to IP address 216.150.16.129, hosted within Amazon.com, Inc. (AS16509) in the United States. The domain utilizes Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and employs a Let's Encrypt SSL certificate (R13), indicating encrypted communication. Detected technologies include Node.js, React, Next.js, and Google Analytics, suggesting a modern, interactive web application designed to mimic legitimate platforms. The page title, 'Log-in | Coinbase Pro | Digital Asset Exchange®,' directly aligns with the targeted brand, Coinbase, and the scam type is classified as a crypto scam. As of July 12, 2026, the domain remains active and is flagged by one security blocklist, with Google Safe Browsing categorizing it under 'SOCIAL_ENGINEERING.' Twelve of ninety-five security vendors on VirusTotal have detected this domain as malicious. The HTTP status code 308 (Permanent Redirect) may indicate attempts to evade detection or redirect victims to further malicious endpoints. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related services are accessed. The use of Vercel infrastructure and modern web frameworks suggests the campaign is designed to appear legitimate, increasing the likelihood of user compromise. Given the domain's age and persistent activity, monitoring for related subdomains or newly registered domains under the same registrar (OVH, SAS) may help identify additional threats. No evidence currently suggests lateral movement or secondary payload delivery, but the presence of Crisp Live Chat could indicate real-time interaction with victims for further exploitation.