connect-coinpro-docs[.]daftpage[.]com

This report details a phishing domain targeting cryptocurrency users. The site, connect-coinpro-docs.daftpage.com, presented a page titled "Coinbase Pro Login: Secure Access Your Account - Official" and impersonated the legitimate Coinbase brand to execute a cryptocurrency scam. The primary threat posed by this domain was credential theft, as it was designed to trick users into entering their login details for a fake Coinbase Pro platform.

Technical analysis reveals significant malicious indicators. VirusTotal flagged the domain with 12 detections out of 95 vendors. It was specifically flagged by security vendors ADMINUSLabs, ChainPatrol, CyRadar, ESET, and Fortinet. Google Safe Browsing flagged the site for social engineering. The domain was registered through OVH, SAS and was created on 2021-10-24. It resolved to IP address 216.150.1.65, hosted on AS16509 (Amazon.com, Inc.) in the United States, and utilized a Let's Encrypt SSL certificate (R13). The domain was also found on 1 blocklist.

As of the time of analysis, the domain is DOWN/OFFLINE, indicating it is no longer actively serving its malicious content. Despite being offline, the domain carries a high risk score of 10 out of 10 and a GridinSoft trust rating of 0 out of 100. Cloaking was detected via content_split, confirming the site attempted to hide its true nature from security scanners. Users who previously interacted with this domain should consider their credentials compromised.