learn-helpcoinbase[.]daftpage[.]com

This domain, learn-helpcoinbase.daftpage.com, is actively impersonating Coinbase, a cryptocurrency exchange platform, as indicated by its page title 'Sign in - Coinbase.com' and confirmed brand target data. Registered on October 24, 2021, the domain remains operational with a high-risk classification due to its involvement in a seed phrase phishing scheme. Infrastructure analysis reveals the domain resolves to IP 216.150.16.1, hosted on AS16509 (Amazon.com, Inc.) in the United States, and uses nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. The site employs a Let's Encrypt SSL certificate (R13) and returns an HTTP 308 status code, suggesting a redirect mechanism. Technologies detected include Node.js, React, Next.js, and Google Analytics, which may facilitate tracking or dynamic content delivery. The domain appears on one security blocklist and is flagged by 13 of 95 security vendors on VirusTotal, with Google Safe Browsing classifying it under 'SOCIAL_ENGINEERING'. While the exact content of the phishing page has not been analyzed, the presence of a seed phrase phishing kit indicates the site likely solicits cryptocurrency wallet recovery phrases or credentials under the guise of Coinbase authentication. Defenders should block the domain and its resolving IP at the network level, monitor for related phishing kit indicators, and alert users to the risk of credential or seed phrase theft. The domain's use of Vercel-hosted infrastructure and HSTS may complicate takedown efforts, warranting continued vigilance.