info-learn-coinbase[.]daftpage[.]com

Analysis of info-learn-coinbase.daftpage.com indicates active brand-impersonation targeting Coinbase users, classified as high-risk. The domain, registered on October 24, 2021, through OVH, SAS, resolves to IP address 216.150.1.193 and is currently flagged by 17 of 95 security vendors on VirusTotal. It appears on two security blocklists—PhishDestroy and PhishingDB—and holds a Gridinsoft trust score of 0/100, reinforcing its malicious classification. The page title, 'Coinbase - Sign in,' directly aligns with the reported brand target, suggesting an intent to deceive users into entering credentials. SSL certification is provided by Let's Encrypt, a common practice among threat actors to lend superficial legitimacy. Detected technologies include Node.js, React, Next.js, Google Analytics, and Crisp Live Chat, which may be used to enhance phishing functionality or track victim interactions. Infrastructure analysis reveals the domain remains operational as of July 12, 2026, with no evidence of takedown. Defenders should treat this domain as a confirmed phishing resource and prioritize blocking at DNS, proxy, or endpoint layers. Further investigation into associated IP ranges and hosting patterns may uncover additional linked threats. The exact content and functionality of the site have not yet been analyzed, but the combination of brand impersonation, low trust scores, and blocklist presence warrants immediate containment.