coinbase-web-home[.]daftpage[.]com

This domain, coinbase-web-home.daftpage.com, is flagged as an active high-risk phishing infrastructure impersonating Coinbase, a cryptocurrency exchange platform. Registered on October 24, 2021, through OVH, SAS, the domain currently resolves to the IP address 216.150.16.129. Analysis indicates the page title explicitly mimics Coinbase's branding, displaying 'Coinbase - Buy and Sell Bitcoin,' which aligns with the observed brand impersonation threat type. Infrastructure analysis reveals the use of Node.js, React, Next.js, and Vercel, alongside standard web technologies such as HSTS, Google Analytics, and Crisp Live Chat. The SSL certificate is issued by Let's Encrypt, a common practice among both legitimate and malicious sites. The domain appears on at least one security blocklist and is flagged by Google Safe Browsing for social engineering. Nine out of ninety-five security vendors on VirusTotal have detected this domain as malicious. Defenders should prioritize blocking this domain at the DNS or network level, as it remains active and poses a direct risk to users. While the exact content and functionality of the site have not been analyzed, the combination of brand impersonation, social engineering flags, and detection by multiple security vendors confirms its malicious intent. No evidence suggests this domain is associated with legitimate Coinbase operations, and its continued activity warrants immediate mitigation.