portal-coinbase-cdn-auth[.]daftpage[.]com

This domain, portal-coinbase-cdn-auth.daftpage.com, presents a high-risk brand impersonation threat targeting Coinbase users. Analysis indicates the page replicates the Coinbase sign-in interface under the title 'Coinbase Sign - In,' designed to harvest login credentials. The threat operates as a fake login portal, likely intended to facilitate unauthorized access to cryptocurrency accounts or deploy secondary payloads such as crypto drainers. The domain’s infrastructure and content closely mimic legitimate Coinbase authentication flows, increasing the likelihood of successful deception among targeted users.

Infrastructure analysis reveals the domain was registered through OVH, SAS on October 24, 2021, and resolves to the IP address 216.150.1.65, hosted within AS16509 (Amazon.com, Inc.). Detection metrics confirm the domain’s malicious nature, with 17 out of 95 security vendors on VirusTotal flagging it as malicious. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is actively labeled as phishing by Google Safe Browsing. The SSL certificate, issued by Let’s Encrypt (R13), further aligns with tactics commonly observed in phishing campaigns to lend false legitimacy to fraudulent sites.

Users who visited portal-coinbase-cdn-auth.daftpage.com should immediately revoke any entered credentials and enable multi-factor authentication on their Coinbase accounts. It is recommended to scan the device used to access the domain for malware or unauthorized access. Affected individuals should monitor their accounts for suspicious transactions and report the incident to the targeted brand’s security team for further investigation. Proactive measures, such as resetting passwords and reviewing connected applications, are advised to mitigate potential account compromise.