auth-coinbasse-doc[.]daftpage[.]com

PhishDestroy identifies auth-coinbasse-doc.daftpage.com as a high-risk brand impersonation threat specifically targeting Coinbase users through credential theft. This domain was designed to trick victims into entering their login credentials on a fraudulent Coinbase Pro login page, putting their cryptocurrency accounts at immediate risk of compromise. The site has been taken offline, but similar domains may still be active.

Technical analysis reveals that this domain was created on October 24, 2021, and registered through OVH, SAS. It resolved to IP address 216.150.16.1 and used a Let's Encrypt / R13 SSL certificate to appear legitimate. VirusTotal flagged this domain with 13 out of 95 security vendors, and it appeared on 2 security blocklists. Google Safe Browsing specifically flagged it for phishing, and the page title was "Coinbase Pro Login: Secure Access Crypto" to impersonate the official service.

To protect against such threats, Coinbase users should always verify the URL before logging in, ensure it matches the official "coinbase.com" domain, and enable two-factor authentication. Never enter credentials on pages reached via unsolicited links. If you have entered information on a similar site, immediately change your Coinbase password and contact support. Use a password manager to prevent credential reuse and enable withdrawal whitelists for added security.