coinbase-pro-secure[.]daftpage[.]com

The domain coinbase-pro-secure.daftpage.com is actively hosting a credential‑harvesting site that mimics Coinbase Pro, as indicated by the page title "Log‑in | Coinbase Pro | Digital Asset®". Infrastructure analysis shows the domain resolves to IP 216.150.16.1, an address owned by Amazon.com, Inc. (AS16509) located in the United States. The site is served over HTTPS using a Let’s Encrypt‑issued certificate (R13) and employs HSTS, suggesting a deliberately configured TLS environment. DNS is delegated to ns1.vercel-dns.com and ns2.vercel-dns.com, confirming the use of Vercel’s DNS service. The hosting stack includes Node.js, React and Next.js, with embedded YouTube embeds, Google Analytics and Crisp live‑chat widgets, all typical of a modern web application. Reputation data is uniformly negative: the domain appears on two security blocklists (PhishDestroy, PhishingDB), receives a Google Safe Browsing classification of SOCIAL_ENGINEERING, and scores 0 / 100 on Gridinsoft’s trust metric. Scamadviser assigns a trust score of 1 / 100. VirusTotal reports 15 of 95 scanners flagging the domain as malicious, reinforcing the detection consensus. The registration record shows the domain was created on 24 Oct 2021 through OVH, SAS, and the site returns an HTTP 308 status, indicating a permanent redirect configuration. The observed phishing kit is identified as a Seed Phrase Phishing kit, aligning with the declared crypto‑scam classification. Defenders should block the domain at perimeter filters, update URL and hash‑based threat feeds, and monitor for related infrastructure (Vercel DNS entries, the associated Amazon IP range, and the OVH registrar). Incident responders should advise users to verify any Coinbase Pro login URLs against official endpoints and to treat any request for seed phrases as malicious. Continuous telemetry collection on the identified IP and DNS records is recommended to detect potential repurposing of the same infrastructure for future campaigns.