eng-coinbasepro-learn[.]daftpage[.]com

This domain is assessed as high-risk and specifically impersonates the brand Coinbase through a deceptive web page designed to mimic the legitimate Coinbase Pro digital asset exchange. The threat type is brand impersonation, aimed at tricking users into divulging sensitive information such as login credentials or financial details.

Analysis indicates that the domain eng-coinbasepro-learn.daftpage.com has been flagged by 18 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicious activity. The domain is registered through OVH, SAS, and currently resolves to the IP address 216.150.1.193, which is located in the United States and associated with Amazon.com, Inc. (AS16509). The domain was created on October 24, 2021, and has appeared on 2 security blocklists, including PhishDestroy and PhishingDB. Google Safe Browsing has also flagged this domain as phishing, further corroborating the threat assessment. The page title, 'Official Site® | Coinbase Pro | Digital Asset Exchang,' is designed to appear legitimate, enhancing the potential for user deception.

To mitigate the risks associated with this brand impersonation threat, users should avoid clicking on any links or entering personal information on this domain. Security teams are advised to update their threat intelligence databases and ensure that this domain is blocked in web filters and email systems. Additionally, monitoring for similar domain names and variations can help prevent future impersonation attempts. Educating users about the signs of phishing, such as suspicious URLs and unexpected emails, is crucial in preventing successful attacks.