web-coinbase-pro-us[.]daftpage[.]com

Analysis of web-coinbase-pro-us.daftpage.com indicates a high-risk phishing operation impersonating Coinbase, specifically targeting cryptocurrency users. The domain, registered on October 24, 2021, currently resolves to 216.150.16.1 under AS16509 (Amazon.com, Inc.) in the United States. The page title, 'Coinbase Pro Login | Secure Crypto Access 🚀,' explicitly mimics Coinbase Pro branding, aligning with the reported scam type labeled as a crypto scam. Security vendor detections on VirusTotal show 10 of 95 engines flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain is actively blocked by at least one security blocklist and remains operational as of July 12, 2026. Infrastructure analysis reveals the use of Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and hosting technologies including Node.js, React, Next.js, and HSTS. Additional third-party integrations such as YouTube, Google Analytics, and Crisp Live Chat are present, which may be leveraged for social engineering or tracking user interactions. The SSL certificate is issued by Let's Encrypt (R13), providing HTTPS encryption without indicating legitimacy. The HTTP status code 308 (Permanent Redirect) suggests potential redirection to further malicious endpoints, though the exact destination remains unverified. No evidence confirms whether this domain functions as a credential harvester, crypto drainer, or another specific attack vector beyond its classification as a crypto scam. Defenders should treat this domain as actively malicious. Recommended actions include blocking resolution at DNS or network perimeter levels, alerting users to avoid interaction, and monitoring for related IOCs such as the IP address 216.150.16.1 or associated technologies. Further analysis of the site's backend or redirection chains may clarify its exact attack methodology, but current indicators warrant immediate containment.