nav-portal-in-base[.]daftpage[.]com

nav-portal-in-base.daftpage.com is a high-risk phishing domain specifically designed to steal cryptocurrency credentials by impersonating Coinbase's login page. The domain is currently offline, but it posed a significant threat while active, targeting users with a fake sign-in interface. This brand impersonation campaign aimed to harvest sensitive login information from unsuspecting Coinbase customers.

This malicious domain was flagged by 17 out of 95 security vendors on VirusTotal, indicating broad detection across the cybersecurity community. It was registered through OVH, SAS on October 24, 2021, and resolved to IP address 216.150.1.193. The domain appears on 2 security blocklists and was flagged by Google Safe Browsing for phishing. The SSL certificate was issued by Let's Encrypt / R13, which is commonly abused by threat actors due to its free and automated issuance process.

Although the domain is now offline, users should remain vigilant against similar threats. PhishDestroy recommends always verifying URLs before entering credentials, especially for cryptocurrency platforms. If you have already interacted with this domain, change your passwords immediately and enable two-factor authentication on your Coinbase account. Report any suspicious activity to Coinbase support and consider using a password manager to detect lookalike domains in the future.