help-coinbasehelp[.]daftpage[.]com

This domain, help-coinbasehelp.daftpage.com, is actively impersonating Coinbase as part of a crypto scam operation. Analysis indicates the domain was registered on October 24, 2021, through OVH, SAS, and currently resolves to IP address 216.150.16.193, hosted on Amazon.com, Inc. infrastructure (AS16509). The page title, 'Sign In | Coinbase.com,' directly mimics Coinbase's branding, and the domain is explicitly flagged for social engineering by Google Safe Browsing. Infrastructure analysis reveals the use of Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and technologies including Node.js, React, Next.js, and HSTS, which are consistent with modern phishing kits designed to appear legitimate. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist, with additional detections reported by 11 of 95 security vendors. The HTTP status code 308 (Permanent Redirect) suggests the domain may be redirecting visitors to another malicious endpoint, though the exact destination is not yet confirmed. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS and network level. Given the use of live chat (Crisp) and analytics (Google Analytics), the operators may be actively monitoring victim interactions. No evidence currently links this domain to a broader campaign, but the infrastructure and targeting align with known crypto scam tactics.