pro-en-coin-logn[.]daftpage[.]com

The domain pro-en-coin-logn.daftpage.com is flagged as a brand impersonation threat targeting Coinbase. The domain is currently offline. Analysis indicates that this domain was created on October 24, 2021, and has been registered through OVH, SAS. The domain resolves to the IP address 216.150.1.65, which is located in the United States and is part of the Amazon.com, Inc. (AS16509) network.

This domain is flagged by 17 of 95 VirusTotal vendors, indicating a high level of suspicion. The page title, 'Coinbase Pro Login | Access Your Advanced Trading ...', closely mimics the legitimate Coinbase Pro login page, suggesting an attempt to deceive users into providing sensitive information. The domain has also been listed on two security blocklists, PhishDestroy and PhishingDB, further confirming its malicious nature. The SSL certificate is issued by Let's Encrypt / R13, which is a common practice for phishing sites to gain user trust.

Given the current offline status of the domain, it is recommended that organizations and individuals who may have encountered this domain perform a thorough review of any credentials or personal information potentially compromised. Security teams should continue to monitor the domain for any signs of reactivation and ensure that relevant blocklists and security measures are updated to prevent future access. Additionally, users should be educated on the signs of phishing and the importance of verifying the legitimacy of login pages before entering sensitive information.