auth-basepro-cdn[.]daftpage[.]com

Analysis indicates that auth-basepro-cdn.daftpage.com is an active phishing domain impersonating Coinbase Pro, a cryptocurrency exchange platform. The domain was registered on October 24, 2021, and remains operational as of July 12, 2026. It is hosted on infrastructure associated with Amazon.com, Inc. (AS16509) in the United States, resolving to the IP address 216.150.1.1. The site's page title, 'Log In | Coinbase Pro | Official Site,' directly mimics the branding of Coinbase Pro, suggesting an intent to deceive users into believing they are accessing a legitimate platform. Technical evidence supports its classification as a high-risk threat. The domain is flagged by Google Safe Browsing for social engineering and appears on at least two security blocklists, including PhishDestroy and PhishingDB. A Scamadviser trust score of 1/100 and a Gridinsoft trust score of 0/100 further corroborate its malicious nature. The domain employs a Let's Encrypt SSL certificate (R13) and utilizes technologies such as Node.js, React, Next.js, and Vercel, which are consistent with modern phishing infrastructure. Additionally, the presence of a 'Seed Phrase Phishing' kit indicates a focus on cryptocurrency theft, targeting users' wallet recovery phrases or private keys. Defenders should treat this domain as an active threat. The HTTP 308 status suggests potential redirection behavior, which may be used to evade detection or route victims through additional malicious infrastructure. While 15 of 95 security vendors on VirusTotal flag the domain, this should not be interpreted as exhaustive coverage, as detection rates can vary. The domain's nameservers (ns1.vercel-dns.com and ns2.vercel-dns.com) and registration through OVH, SAS, align with patterns observed in other phishing campaigns.