en-us-coinbase-pro[.]daftpage[.]com

Analysis dated July 23 2026 records that the domain en-us-coinbase-pro.daftpage.com remains active and hosts a credential‑theft page targeting Coinbase Pro users. The site was registered through OVH, SAS and first appeared on 24 October 2021. DNS resolution points to 216.150.16.1, an address owned by Amazon.com, Inc. (AS16509) and geolocated in the United States. HTTP requests receive a 308 permanent redirect response, and the TLS certificate is issued by Let’s Encrypt (R13). The page title returned by the server is “Log-in | Coinbase Pro | Digital Asset Exchange®”, directly copying the legitimate brand’s wording.

Security‑vendor telemetry shows that 17 of 95 VirusTotal scanners flag the domain, and it appears on a single external blocklist. Google Safe Browsing classifies the URL as social‑engineering, while PhishDestroy has already blocked it. Independent trust‑rating services assign extremely low scores: Gridinsoft 0 / 100 and Scamadviser 1 / 100. The infrastructure stack includes Node.js, React, Next.js, Vercel hosting, HSTS, Google Analytics and Crisp Live Chat, indicating a modern web‑app framework rather than a simple static clone.

Evidence confirms that the domain impersonates Coinbase and is categorized as a crypto‑scam. No additional public samples of the HTML content have been released, so visual or functional details remain unverified. Defenders should continue to block the domain at DNS and proxy layers, monitor for connections to 216.150.16.1, and update endpoint detection rules with the observed User‑Agent and SSL fingerprint. Because the certificate is publicly trusted, user‑education messages must stress that HTTPS alone does not guarantee legitimacy, and that any credential entry on this URL should be treated as compromised.