coinss-web-pro[.]daftpage[.]com

This domain, coinss-web-pro.daftpage.com, operates as a high-risk phishing site specifically designed to impersonate Coinbase, a widely used cryptocurrency exchange platform. The site presents a fraudulent login interface titled 'Secure Login || Coinbase Pro Account,' mimicking the legitimate Coinbase Pro authentication portal. Analysis indicates the domain was engineered to harvest user credentials, enabling unauthorized access to cryptocurrency accounts and facilitating financial theft or further malicious activity targeting Coinbase customers. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on October 24, 2021, through OVH, SAS, and resolves to the IP address 216.150.1.65, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. The site appears on two independent security blocklists, and Google Safe Browsing has classified it as a phishing threat. The SSL certificate, issued by Let's Encrypt (R13), does not mitigate the inherent risk, as phishing sites frequently employ valid encryption to appear legitimate. Users who accessed coinss-web-pro.daftpage.com or entered credentials on this site should immediately take corrective action. Affected individuals must change their Coinbase account passwords and enable multi-factor authentication if not already active. It is recommended to review recent account activity for unauthorized transactions and report any suspicious behavior to the platform’s support team. Additionally, users should monitor associated email accounts for signs of compromise and consider revoking access to any linked third-party applications until the full scope of exposure is assessed.