via-secure-coib-base[.]daftpage[.]com

The domain via-secure-coib-base.daftpage.com has been identified as a brand impersonation threat, specifically targeting Coinbase. This domain is currently offline but was previously active and posed a high-risk phishing threat. The domain's page title, 'Log-in | Coinbase Pro | Digital Asset', strongly indicates its intent to deceive users into entering sensitive information under the guise of a legitimate service.

Technical analysis reveals that the domain was flagged by 13 out of 95 security vendors on VirusTotal, highlighting its malicious nature. The domain was registered via OVH, SAS and was created on October 24, 2021. It was hosted on an IP located in the United States (216.150.1.1), affiliated with AS16509 (Amazon.com, Inc.). The domain also appears on one security blocklist and is flagged by Google Safe Browsing as phishing. Additionally, it employed a Let's Encrypt SSL certificate, which is often used in phishing campaigns to lend credibility to fraudulent sites.

Currently, the domain is offline, which mitigates immediate risk. However, users should remain vigilant for similar phishing attempts. It is recommended to maintain updated security software and enable multi-factor authentication to protect accounts from unauthorized access. Additionally, users should verify URLs and avoid clicking on suspicious links or attachments. Organizations should educate employees about phishing tactics to enhance their overall security posture and prevent credential compromise.