sso-coinbase-sso[.]daftpage[.]com

The domain sso-coinbase-sso.daftpage.com is currently flagged as a high‑risk brand‑impersonation site targeting Coinbase. The page title returned from the host is "Login Security - Coinbase," indicating an explicit attempt to lure users familiar with Coinbase authentication flows. The threat is classified as a cryptocurrency‑related impersonation, and the site remains active as of 12 July 2026.

Infrastructure analysis shows the domain was registered on 24 October 2021 through OVH, SAS. DNS resolution is handled by ns1.vercel-dns.com and ns2.vercel-dns.com, and the A‑record points to 216.150.16.129, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The service presents a valid TLS certificate issued by Let’s Encrypt (R13) and returns an HTTP 308 redirect, suggesting the site is configured to forward traffic rather than serve content directly. Reputation data indicate a Gridinsoft trust score of 0 / 100, placement on one security blocklist, and a detection by PhishDestroy. VirusTotal analysis records 12 out of 95 security vendors flagging the domain as malicious.

Technical fingerprints reveal a stack built on Node.js with React and Next.js, hosted on Vercel, and augmented by HSTS, Google Analytics, Crisp Live Chat, and embedded YouTube elements. The observed phishing kit is identified as a Seed Phrase Phishing kit, which is commonly used to harvest cryptocurrency recovery phrases. Given the combination of a brand‑specific page title, a low trust score, a known phishing kit, and multiple vendor detections, defenders should treat the domain as hostile. Recommended actions include adding the domain to DNS and proxy blocklists, monitoring for outbound connections to the associated IP, and alerting security teams to any attempted credential or seed‑phrase submissions targeting Coinbase users.