service-coinbse-coms[.]daftpage[.]com

The domain service-coinbse-coms.daftpage.com was first registered on October 24, 2021 and remains active as of July 12, 2026. It presents the page title "Coinbase.com Sign In | Log In" and explicitly impersonates the Coinbase brand, indicating a targeted cryptocurrency credential‑stealing campaign. Google Safe Browsing classifies the site under the "SOCIAL_ENGINEERING" category, and it appears on one security blocklist, confirming its malicious intent.

Infrastructure analysis shows the domain resolves to IP address 216.150.16.193, which belongs to ASN AS16509 operated by Amazon.com, Inc., placing the hosting in the United States. The site serves an HTTP 308 redirect and presents a TLS certificate issued by Let’s Encrypt (R13). DNS resolution is handled by ns1.vercel-dns.com and ns2.vercel-dns.com, consistent with a Vercel hosting environment. Detected technologies include Node.js, React, Next.js, Vercel, HSTS, Google Analytics, and Crisp Live Chat, suggesting a modern web stack often leveraged by phishing kits.

Risk assessment is reinforced by a Gridinsoft trust score of 0 out of 100 and detection by 12 out of 95 VirusTotal security vendors. The combination of a low trust score, Google Safe Browsing flag, and inclusion on a blocklist elevates the threat level to high. The domain is actively blocked by PhishDestroy, indicating that at least one mitigation service has taken action, yet the site remains reachable and continues to host the impersonation page.

Defenders should add service-coinbse-coms.daftpage.com to DNS and URL filtering policies, enforce TLS inspection to capture the redirect, and monitor outbound traffic for connections to the IP 216.150.16.193. Continuous threat‑intel feeds should be consulted for any re‑use of the same infrastructure in related campaigns. Given the confirmed brand impersonation and the active status of the domain, proactive blocking and user awareness campaigns focusing on Coinbase credential safety are recommended.