secure-coinbase-en-auth[.]daftpage[.]com

This domain is flagged as a high-risk brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. The site mimics official Coinbase authentication portals, presenting itself under the page title 'Official® Site | Coinbase Pro | Coinbase Advanced Trade,' which aligns with known phishing tactics designed to harvest user credentials and financial data. Analysis indicates the domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.16.1, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by Let's Encrypt (R13), a common choice among malicious actors due to its accessibility. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and is flagged by Google Safe Browsing for phishing. VirusTotal reports 23 out of 95 security vendors detecting the domain as malicious, confirming its classification as a phishing endpoint. Mitigation steps include immediate blacklisting of the domain and its associated IP (216.150.16.1) across network security controls. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems and monitor for connections to the domain or IP. User awareness training should emphasize the risks of brand impersonation, particularly for financial platforms, and encourage verification of URLs before entering credentials. Given the domain's current offline status, continuous monitoring for reactivation or migration to new infrastructure is recommended.