help-coin-bsse-cdn[.]daftpage[.]com

Analysis of help-coin-bsse-cdn.daftpage.com shows a high‑risk, active brand‑impersonation campaign targeting Coinbase users. The domain resolves to 216.150.16.193, an Amazon.com, Inc. address (AS16509) located in the United States, and is hosted on infrastructure that uses Vercel DNS (ns1.vercel-dns.com, ns2.vercel-dns.com). The site presents a TLS certificate issued by Let’s Encrypt (R13) and returns an HTTP 308 redirect, indicating intentional traffic steering. The page title “Official Site* | Coinbase Pro - Buy and Sell Bitcoi” explicitly references Coinbase, confirming the impersonation claim. Technical fingerprinting reveals a Node.js stack with React and Next.js, along with embedded YouTube content, Google Analytics tracking, and Crisp live‑chat widgets, all typical of modern phishing kits. The domain was created on 24 Oct 2021 via OVH, SAS, and has been listed on two independent blocklists (PhishDestroy, PhishingDB). Google Safe Browsing flags it for social engineering, and VirusTotal reports 13 of 95 scanners flagging the host as malicious. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. While the exact payload or credential‑harvesting mechanism has not been publicly disclosed, the convergence of brand impersonation, hostile redirects, and multiple security vendor detections warrants immediate defensive action. Organizations should block the domain at network and endpoint layers, add it to URL filtering and threat‑intel feeds, and monitor for related C2 patterns originating from the same IP range. Continuous re‑evaluation is advised in case the infrastructure evolves or new indicators emerge.