new-app-secure-base[.]daftpage[.]com

The domain new-app-secure-base.daftpage.com is assessed as a high-risk threat due to its involvement in brand impersonation, specifically targeting Coinbase. This type of threat poses significant risks to users who may be tricked into providing sensitive information, such as login credentials, to what they believe is a legitimate Coinbase service.

Analysis indicates that the domain was registered through OVH, SAS on October 24, 2021. The domain resolves to the IP address 216.150.1.129, which is located in the United States and is associated with AS16509 Amazon.com, Inc. The SSL certificate for this domain is issued by Let's Encrypt, a widely used certificate authority that can be obtained without stringent verification. The domain has been flagged by 18 out of 95 security vendors on VirusTotal, and it appears on two security blocklists: PhishDestroy and PhishingDB. Google Safe Browsing has also identified this domain as a phishing site. These multiple detections and the presence on reputable blocklists strongly suggest that the domain was actively used for malicious purposes.

To mitigate the risks associated with this domain, it is recommended that users avoid clicking on any links or entering personal information on any website that closely mimics the Coinbase brand but has a different or unfamiliar domain name. Security teams should update their phishing detection systems to include this domain and its associated IP address. Additionally, monitoring tools should be configured to alert on any future activity from this domain or similar impersonation attempts. Organizations should also conduct user training to recognize and report phishing attempts, emphasizing the importance of verifying the domain and URL before interacting with any online service.