webo-coinsstat-web[.]daftpage[.]com

The domain webo-coinsstat-web.daftpage.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting Coinbase users. Infrastructure analysis shows the domain resolves to IP 216.150.16.65, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Registration details indicate the domain was created on 24 October 2021 through OVH SAS, and DNS is served by ns1.vercel-dns.com and ns2.vercel-dns.com. The site presents an HTTP 308 response and serves a valid Let's Encrypt R13 certificate, enabling encrypted traffic. Detected technologies include Node.js, React, Next.js, Vercel hosting, HSTS enforcement, Google Analytics, Crisp Live Chat, and embedded YouTube content. The page title "Coinbase - Buy & Sell Bitcoin, Ethereumñ" directly references the Coinbase brand, confirming the impersonation intent. Google Safe Browsing flags the domain for SOCIAL_ENGINEERING, and it appears on two public blocklists (PhishDestroy and PhishingDB). VirusTotal reports 13 of 95 security vendors flag the domain, while Gridinsoft assigns a trust score of 0 / 100. The threat is identified as a crypto‑scam, likely attempting to harvest credentials or funds from unsuspecting Coinbase users. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no visual analysis of the landing page is available. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to the associated IP, and consider sinkholing the domain to disrupt the campaign. Continuous threat‑intel feeds should be consulted for any updates to detection counts or new indicators of compromise.