en-coinhelp-learn[.]daftpage[.]com

PhishDestroy has flagged en-coinhelp-learn.daftpage.com as a brand impersonation attack targeting Coinbase. This domain was designed to harvest credentials by presenting a fraudulent Coinbase sign-in page, likely leading to account theft. The threat is categorized as high risk due to its direct impersonation of a major cryptocurrency exchange.

The domain was created on October 24, 2021, through registrar OVH SAS, and resolves to IP 216.150.16.193. It uses a Let's Encrypt SSL certificate (R13) to appear legitimate. VirusTotal analysis shows 14 out of 95 security vendors flagging it as malicious, and Google Safe Browsing explicitly marks it as phishing. The domain appears on one security blocklist.

As of the latest check, the domain is offline, indicating it may have been taken down or suspended. However, the risk remains that similar domains could be active. Users are advised to always verify URLs directly with Coinbase's official site and never enter credentials on third-party pages. PhishDestroy continues to monitor for related threats.