sin-coinbase-authd[.]daftpage[.]com

The domain sin-coinbase-authd.daftpage.com is flagged as a high-risk brand impersonation threat, specifically targeting the cryptocurrency exchange platform Coinbase. Analysis indicates that this domain was likely used to deceive users into believing they were interacting with a legitimate Coinbase service, potentially to harvest sensitive information such as login credentials, personal details, and financial data.

Infrastructure analysis reveals that the domain was created on October 24, 2021, and is registered through OVH, SAS. It resolves to the IP address 216.150.1.65, which is located in the United States and associated with Amazon.com, Inc. (AS16509). The domain is currently marked as offline and has been taken down. However, it has been flagged by 13 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion. Additionally, the domain appears on one security blocklist and has been blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt / R13, a common practice for phishing sites to appear more legitimate.

Users who visited sin-coinbase-authd.daftpage.com are advised to immediately change their Coinbase account passwords and enable two-factor authentication (2FA) if not already active. It is also recommended to monitor account activity for any unauthorized transactions and to report any suspicious activity to Coinbase's support team. For further protection, users should run a full system scan to ensure no malware was installed and consider using a reputable password manager to avoid falling victim to similar threats.